Limiting order and customer data exports at an e-commerce agency

An order export is a CSV file, a spreadsheet with a row for each item ordered. Shopify’s list of export fields includes the billing and shipping name, address and phone number. Looking at one order on screen is different. An export moves many buyers’ details onto a staff member’s computer in one click. At an e-commerce agency, limiting exports takes three things together: fewer people who can export, rules for the files, and a record you can check.

The file rules in the last section also apply to Amazon and other marketplaces. How to get staff into a store in the first place is in getting agency staff into a client’s Shopify or BigCommerce store.

Turning off exports in Shopify

Shopify lists View and Export as separate permissions under Orders, and Customers and Draft orders each have their own Export. So a person who ships orders can have View plus Fulfill and ship, without Export.

Selecting the top item of a category selects every permission inside it, and any permissions it depends on in other categories. If you select Orders at the top, Export comes along with it, so select each item one at a time.

Permissions apply to the whole store. Shopify Help says you can’t limit them to individual orders, products or customers. It names two exceptions: permissions for specific apps or sales channels, and a business-to-business setting that limits a user to assigned company locations.

How the file arrives depends on its size. Export 50 orders or fewer, or the current page, and the file downloads straight to the device. Export more, or export by date, and Shopify emails the file to the person who ran it and to the store owner. If the owner’s address belongs to the client, the client sees every large export.

For records, the store activity log’s examples don’t include exports, and Shopify Help doesn’t say whether exports are logged. The log shows at most 250 results and can’t be exported.

Turning off exports in BigCommerce

BigCommerce also keeps exports apart from day-to-day order work. Its permissions table lists Export Orders and Export Customers as their own permissions. Manage Orders gives access to viewing and searching orders and shipments, and to actions like printing invoices and packing slips. A person who ships orders can have Manage Orders with Export Orders left off.

Export Customers needs Manage Customers turned on first, so it doesn’t come by itself. Manage Customers doesn’t require Export Customers, so a person can look up buyers without exporting them.

Apps are a second route. BigCommerce opens marketplace apps to each user under Single Click Apps. If an installed app can export orders, giving a user that app gives them that export too. The high-risk Launch applications permission opens every installed app at once. Check each user’s app list along with their permissions.

BigCommerce’s Staff Action Log records each control panel change with the user and time, but its examples don’t include exports, and the help article doesn’t say whether they’re logged.

Where California law comes in

If your client is a “business” under the California Consumer Privacy Act (CCPA) and gives your agency its buyers’ data, its contract with you has to cover that data. A “business” here is a for-profit company doing business in California that meets a size or data threshold (1798.140(d)). Cal. Civ. Code 1798.100(d) requires the contract to limit the data to specified purposes. It must also give the client the right to take reasonable steps to check how you use it. Section 1798.100(e) separately requires the business to keep reasonable security for the personal information it collects. An agency that can say who can export and where the files go can answer the client’s checks under 1798.100(d)(3) and show the security that subsection (e) asks for.

Consumers can also sue over some breaches. Section 1798.150 lets a consumer recover $107 to $799 per consumer per incident (the statute’s $100 to $750, adjusted for inflation), or actual damages if higher. It applies when certain unencrypted and unredacted data is stolen or exposed because a business failed to keep reasonable security. That data is narrower than an order export. It covers a name combined with certain other items (1798.81.5(d)(1)(A)). Those include a Social Security number, a driver’s license or other ID number, a card number with its security code, and medical or health insurance details. An email address with a password or security answer that opens the account is covered too. Names, addresses and phone numbers alone aren’t on the list. Check what your client’s export columns actually include before you assume either way.

Rules for what permissions can’t stop

If store permissions can’t take exports away, agree on the rest with the client.

1. Who may export, and why. Name the people and the tasks that need an export, such as shipping or sales totals. Without that list, you can’t tell whose permission to remove.
2. Where files may be kept. Limit them to a set folder on company-managed computers, and rule out personal email and personal devices. To send a file to the client, put it in a shared folder the client controls instead of attaching it to an email.
3. When files are deleted. Delete each file when the task ends, and write down that you did.
4. A log of exports. If the store doesn’t record exports, log who exported, when, which range, for what, and when the file was deleted. This is what you show a client who asks. It relies on staff reporting their own exports, so a missed entry won’t show up anywhere in the store.