- How do I install soved/laravel-gdpr in a Laravel application?
- Install it with Composer using composer require soved/laravel-gdpr, then publish the package config and migrations. Run your migrations and apply the provided Eloquent traits to the models that represent data subjects. A competent Laravel developer can usually reach a working consent and export flow in days, but the real effort is mapping which tables and columns contain personal data.
- Which Laravel and PHP versions does soved/laravel-gdpr support?
- The package ships as a standard Laravel package with its own composer.json constraints, so check the repository's composer.json and CI matrix for the exact Laravel, PHP, and database versions covered. The provided overview does not list a version matrix, so confirm it against your application's stack before committing. This is important because published migrations and model traits couple your schema to the package.
- Does soved/laravel-gdpr handle cookie consent and consent management?
- Yes, it provides cookie and consent management and stores consent relationally by subject, purpose, version, and timestamp. That relational model is a good primitive for proving informed, specific, and withdrawable consent, provided you also persist the policy version and the UI text shown at capture. It does not cover adtech consent frameworks such as TCF or Google Consent Mode v2, so those integrations remain your responsibility.
- How does soved/laravel-gdpr support GDPR data export and DSAR requests?
- It provides data export tooling through configurable models, artisan commands, and queued jobs for long-running DSAR work. Export format and column selection are configuration surfaces, so they should be reviewed by legal and security before use in production. DSAR bundles are high-value targets, so store them encrypted at rest, use short-TTL signed URLs, authorize the download route, and audit who downloaded them.
- How do I anonymize or delete user records with soved/laravel-gdpr?
- The package offers anonymization and flexible deletion or redaction through configurable traits, models, and artisan commands. Erasure is model-driven via configuration rather than automatic reflection, which gives you a predictable blast radius but means the config must be hand-authored from a real data map. Be careful with hard deletes because they can break referential integrity or violate statutory retention, and anonymization must be selective and irreversible.
- Is soved/laravel-gdpr a complete GDPR compliance solution?
- No. It automates the mechanics of GDPR such as consent capture, DSAR export, erasure or anonymization, and audit-friendly logging, but it is not a compliance program in a box. You still own legal mapping, data inventory, records of processing, DPIAs, processor and DPA registers, transfer mechanisms, DSAR identity verification, breach notification timelines, and adtech consent. Budgeting the package as GDPR done is the primary failure mode.
- How do I configure which models and columns are exported or anonymized?
- Configuration lives in the publishable config/gdpr.php file and in the Eloquent traits you apply to subject models. The package is deliberately model-driven rather than reflection-based, so you explicitly declare what is exported, deleted, or anonymized. Treat that configuration as a product artifact that must be authored from a real data inventory and reviewed by legal and security before it touches production.
- Can soved/laravel-gdpr handle legal retention requirements and data holds?
- The package does not decide your retention policy for you. You must identify which records are legally retained, such as invoices, tax, and employment records, and configure those to be anonymized rather than hard-deleted. A misconfigured column list can cause a silent PII leak or unrecoverable data loss, so retention mapping and tests are a major part of the engineering effort.
- Is soved/laravel-gdpr safe for production and multi-tenant Laravel apps?
- It is a lightweight, Laravel-idiomatic package that composes naturally with existing auth, queues, and storage, but it has a single maintainer, roughly 300 stars, and no vendor SLA. Pin the version and vendor the source if you rely on it for legal evidence, and wrap the facade in your own service layer to preserve an exit. For multi-tenant or white-label apps, explicitly scope and isolate consents per tenant in your configuration and traits.
- What are the alternatives to soved/laravel-gdpr and is it well maintained?
- It is MIT licensed with a recent release, but the bus factor is one, so treat it as a build-versus-fork accelerator rather than a strategic dependency. Alternatives include building the consent, export, and erasure mechanics in-house or adopting broader compliance platforms that cover more regulatory surface. Whichever path you choose, verify the Laravel and PHP version matrix, test upgrades against your published migrations, and keep an exit plan.