GDPR compliance
Anonymising customer data
A production copy holds your customers' personal data, on an environment that is often less protected and reachable by contractors. Anonymisation replaces that data with neutral, consistent values: the shop stays usable for testing, but nobody in it is identifiable any more.
| Target | What gets replaced |
|---|---|
| Customers | First and last name, e-mail, password, date of birth, note, company, company number, reset tokens |
| Addresses | Name, street, city, postcode, phone numbers, VAT number — the country is kept |
| Customer service threads | Contact e-mail address |
| Customer service messages | Message body, attachment, IP address |
| Connections | IP address, referrer |
| Connection sources | Referrer, origin URL, keywords |
The address country is deliberately kept: shipping and VAT calculations stay realistic, which is exactly what a test environment is for. E-mails are derived from the customer id so they stay unique, and the password is replaced by a deliberately invalid hash — no login is possible with an anonymised account, even if the staging site is exposed.
The operation cannot be undone and requires a typed confirmation. It too refuses to run on a shop open to the public. A dry run shows you beforehand how many rows are concerned, with a before/after sample.
You can narrow the run to a single customer, named by e-mail or id: that is the move expected when someone exercises their right to erasure and you have to carry it through to your working copies.