I'm really struggling with Magento 2 and GDPR compliance. In magento's most recent memorandum regarding GDPR it states that it is ready for GDPR. Having checked the most recent version stable version of Magento 2 (2.2.4) I can see that, at a minimum, there is no functionality for customer account deletion or updates to the newsletter signup process and the consent and authorization for specific data usage when signing up. I can see that there are various paid extension that offer this functionality at a cost but I would have thought that considering how important GDPR is worldwide that Magento would have made this core functionality. Any comments or advice would be most appreciated.
2 Answers
I agree with you and share the same pain but Magento is US based company and GDPR might be in their roadmap but surely not the top priority for them hence they left it on community / extension developers to solve the problem for European customers. I would highly recommend you to read the below article especially Magento GDPR checklist section and that will give you an idea that what can be done to achieve GDPR compliance for your website.
https://www.scommerce-mage.com/magento-gdpr-compliance.html
Hope it helps
I want to give you 1 opinion if you just need the basic features to follow the GDPR you can download it for free here: https://github.com/mageplaza/magento-2-gdpr . It is ready for compliance with the GDPR and includes: Permanently delete customers' accounts, Completely remove default addresses. However, you can also see more features of the pro version.
