---
title: Missing mandatory GDPR compliance webhooks
description: >-
  Detects apps missing mandatory compliance webhooks (`shop/redact`,
  `customers/data_request`, `customers/redact`).
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/missing-compliance-webhooks
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/missing-compliance-webhooks.md
---

# Missing mandatory GDPR compliance webhooks

Detects apps missing mandatory compliance webhooks (`shop/redact`, `customers/data_request`, `customers/redact`).

| Detail | Value |
| - | - |
| Check ID | `MISSING_COMPLIANCE_WEBHOOKS` |
| Severity | Medium |
| How it runs | Deterministic scan and agent review |

***

## Vulnerable example

## shopify.app.toml

```toml
[webhooks]
api_version = "2025-10"


  [[webhooks.subscriptions]]
  topics = [ "app/uninstalled" ]
  uri = "/webhooks/app/uninstalled"


# The three mandatory privacy topics are missing. Every public
# app has to subscribe to them, whether or not it stores
# customer data.
```

***

## How to fix

Add the missing webhook subscriptions to `shopify.app.toml`.

For more detail, see [Mandatory webhooks](https://shopify.dev/docs/apps/webhooks/configuration/mandatory-webhooks).

## shopify.app.toml

```toml
[webhooks]
api_version = "2025-10"


  [[webhooks.subscriptions]]
  topics = [ "app/uninstalled" ]
  uri = "/webhooks/app/uninstalled"


  [[webhooks.subscriptions]]
  uri = "/webhooks/customers/data_request"
  compliance_topics = [ "customers/data_request" ]


  [[webhooks.subscriptions]]
  uri = "/webhooks/customers/redact"
  compliance_topics = [ "customers/redact" ]


  [[webhooks.subscriptions]]
  uri = "/webhooks/shop/redact"
  compliance_topics = [ "shop/redact" ]
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***