- What is milenmk/laravel-gdpr-exporter used for?
- It helps Laravel applications respond to GDPR subject-access and data-portability requests by collecting a user's personal data from configured Eloquent sources and producing a downloadable export. It standardizes model and column discovery, serialization, archive creation, and delivery notification. It is not a complete DSAR program; you still need an authoritative data map, legal sign-off, and an operational runbook.
- How do I install laravel-gdpr-exporter?
- Install it with Composer using composer require milenmk/laravel-gdpr-exporter, then publish its configuration and define the models and columns that contain personal data. Your application should already have queue workers, a durable storage disk, and mail configured for asynchronous export generation and delivery. Check the repository README for the exact publish and setup commands.
- Which Laravel versions does this GDPR exporter support?
- The technical assessment positions it for Laravel applications in the 8 through 11 range, but the release notes do not clearly list PHP and Laravel support windows. Confirm the composer.json constraints against your application's upgrade horizon before adopting it. If you run older or newer Laravel versions, test on a branch first.
- How do I configure which user data gets exported?
- Configuration is config-driven: you specify the Eloquent models and columns that constitute personal data, and the package assembles those sources into an export. The hard part is maintaining an authoritative inventory with DPO sign-off, not writing the configuration array. Build the data map incrementally and republish config when new keys appear in a release.
- Does it support Livewire?
- Yes, the package description explicitly includes Livewire support, so it can fit applications that expose user-facing or admin export flows through Livewire components. You should still verify Livewire version compatibility for your Laravel release and test the flow with your queue and storage setup. Livewire support does not remove the need to define data sources correctly.
- Is laravel-gdpr-exporter suitable for multi-tenant or microservice architectures?
- It is a good fit for a conventional Laravel monolith where a data subject's records live in first-party Eloquent models on one database connection. It is a poor sole solution for multi-tenant databases, microservices, object storage, event streams, or third-party SaaS processors; there it becomes one contributor and you must build the aggregation layer. Decide early whether you are exporting from one app and one database or coordinating a distributed estate.
- Does it handle large datasets, relations, soft deletes, and file uploads?
- The package is designed around config-driven Eloquent model and column discovery, while the available notes do not confirm chunking, relation handling, soft-deleted records, or non-column data such as uploads and JSON blobs. Test those cases explicitly and review the source before relying on it for statutory completeness. For users with large datasets, verify whether queries are chunked or loaded into memory.
- How do I prevent one user's export from containing another user's data?
- The assessment flags query scoping as a key question and does not confirm a test proving subject isolation. Add application-level tests that create two users with overlapping records and assert the generated archive contains only the requesting subject's rows. Treat cross-subject leakage as a compliance incident, not a normal bug.
- What changed between version 1.3.2 and 1.4.0?
- The 1.4.0 release body is only an auto-generated compare link, with no feature summary, migration notes, or security reference. The minor bump is consistent with additive, non-breaking change under semver, but that is self-certified. Read the diff and composer.json constraints to check for new config keys, archive format changes, or support-window changes before upgrading.
- What are the alternatives to laravel-gdpr-exporter and what maintenance risks should I consider?
- Alternatives include writing a small in-house exporter, using broader compliance tooling, or adopting a DSAR platform if your data is spread across services and SaaS processors. This package is narrow and Eloquent-focused, and it has a single maintainer, so the bus factor is one on a legally consequential path. Pin versions, review release diffs, keep your own export tests and data map, and maintain a fallback manual or in-house export path.