gdpr-rails

GDPR for Rails

GDPR governs personal data of EU residents. The technical asks: let users see, export, correct, and delete their data; record the lawful basis; minimize data collection; notify breaches in 72 hours. This skill is the engineering side — get a privacy lawyer for the legal program.

The opinion

Build a Data Subject portal (export + delete) from day one — bolted on later is painful. Record lawful basis on every personal-data field (consent / contract / legitimate interest). Use pseudonymisation (replace identifiers with reference IDs) for analytics. Audit logs of personal-data access survive erasure. Sign Data Processing Agreements with every vendor handling EU data. Skip the cookie banner if you only use strictly-necessary cookies; otherwise use a consent-management platform (CMP).

What's personal data

Anything that identifies a person OR can be combined with other data to do so:

• Name, email, phone, address, DOB
• IP address, device ID, advertising ID, cookies
• Photos, voice recordings
• Account IDs, order history
• Location data
• Behaviour data when linked to a user

If you can answer "is X about a specific person?" with yes (or "with effort"), GDPR applies.

Pattern 1: Data Subject Access Request (DSAR) export

class DataSubjectRequest < ApplicationRecord
  belongs_to :user
  enum :request_type, { export: 0, deletion: 1, correction: 2 }
  enum :status, { pending: 0, in_progress: 1, completed: 2, denied: 3 }

  validates :request_type, presence: true
end

class DsarExporter
  def initialize(user)
    @user = user
  end

  def call
    {
      account: account_data,
      orders: orders_data,
      activity: activity_data,
      consents: consent_data,
      messages: messages_data
    }
  end

  private

  def account_data
    @user.attributes.except("password_digest", "encrypted_password")
  end

  def orders_data
    @user.orders.map { |o| o.attributes.merge(lines: o.lines.map(&:attributes)) }
  end

  def activity_data
    # GDPR Art. 15 requires the full dataset — no silent truncation.
    AuditLog.where(user: @user).pluck(:action, :ip_address, :created_at)
  end

  def consent_data
    @user.consents.pluck(:purpose, :given_at, :revoked_at)
  end

  def messages_data
    Message.where(from_user: @user).or(Message.where(to_user: @user)).pluck(:subject, :body, :created_at)
  end
end