- Can I use specshaper/gdpr-bundle in a Laravel application?
- It is a Symfony bundle built on Symfony's kernel, DI container, services.yml compiler passes, and Doctrine metadata, so it does not install or run natively in Laravel. There is no Laravel service provider, no Eloquent integration, and no bundle system in Laravel. The practical path is to read it as a reference model and reimplement the concepts using Laravel's Encrypter, custom Eloquent casts, and queued jobs.
- What does specshaper/gdpr-bundle actually do for GDPR compliance?
- It provides configurable anonymization and pseudonymization rules, consent management helpers, and workflows for data subject requests such as access and erasure. It integrates with Doctrine entities and configurable policies to identify personal data and apply privacy workflows. It is a tooling bundle, not a complete compliance program, and it does not by itself cover Articles 15/17/20, consent capture, or processor agreements.
- Is specshaper/gdpr-bundle maintained and production-ready?
- The repository has been dormant since 2022 and the latest release is 3.0.1-alpha, with no stable 3.0.0 in evidence. It targets Symfony 3, which reached end of life in November 2021, and an alpha on a single-maintainer repo is not a safe foundation for regulated data. Treat it as a reference implementation or spec source rather than a production dependency.
- How do I install and configure specshaper/gdpr-bundle?
- Installation is via Composer as a Symfony bundle, followed by registering the bundle in the Symfony kernel and configuring services through the bundle's YAML configuration. It relies on Symfony's DI container and Doctrine metadata, so setup assumes a full-stack Symfony application. For Laravel, there is no supported installation path; any use requires porting the domain model.
- Does specshaper/gdpr-bundle work with Laravel 10 or Laravel 11?
- No. The package is a Symfony bundle and declares no Laravel service provider, facade, or Eloquent support, so Laravel version compatibility is not applicable. Laravel 10 and 11 applications cannot load it as a package. You would need to extract the classification and encryption-hook design and rebuild it against Laravel's container and ORM.
- What are the alternatives to specshaper/gdpr-bundle for Laravel GDPR compliance?
- For Laravel, look at packages that provide personal-data anonymization, consent tracking, and data-subject export and deletion workflows with native Eloquent and queue support. If none fit, implement a small internal layer using Laravel's Encrypter, custom casts, model attributes for classification, and queued export and erasure jobs. The GDPR bundle can still serve as a design reference for declarative classification and persistence-boundary encryption.
- Can I test specshaper/gdpr-bundle before using it?
- The context provides no test-suite signal, and the project is dormant with an alpha release, so do not assume a maintained test suite. If you evaluate it, run it inside a throwaway Symfony 3 environment and inspect the service definitions and encryption dependency. For Laravel, testing would mean testing your own reimplementation, not the bundle.
- What encryption does specshaper/gdpr-bundle use for personal data?
- The encryption layer is delegated to a separate EncryptBundle dependency, so cipher choice, IV handling, key source, and key rotation are questions for that second package. That widens the transitive dependency chain in the sensitive path and adds another abandonment surface. The GDPR bundle itself does not document cipher or key-management details, and the EncryptBundle has not been vetted here.
- What are the production risks of using specshaper/gdpr-bundle?
- The main risks are compliance scope and supply chain. The bundle gestures at encryption and reporting but does not cover key GDPR workflows such as access, erasure, portability, consent capture, or processor agreements. It also depends on an unvetted EncryptBundle, ships as an alpha on a dormant repo, and targets an end-of-life Symfony version, all of which are high-risk for regulated data.
- How do I port specshaper/gdpr-bundle concepts to Laravel?
- Read the 3.x branch for the declarative classification schema and the persistence-boundary encryption hook, then reimplement them with PHP 8 attributes, an Eloquent model-scanning command, custom casts, and Laravel's Encrypter. Replace Doctrine metadata with Eloquent model discovery and move export and erasure work into queued jobs. This reference-implementation path is low risk and moderate effort, and it avoids a runtime dependency on the bundle.