Gdpr Bundle Laravel Package

Getting Started

The first thing to internalize is that specshaper/gdpr-bundle is a Symfony 3 bundle, not a Laravel package. There is no service provider, no facade, and no config/gdpr.php that Laravel's auto-discovery will pick up. Treat it as a reference implementation rather than a dependency you composer require into a Laravel app.

Minimal steps:

1. Read the source first — clone the repo and focus on three things: the entity/field annotations that define a data category, the encryption helper/service that wraps mogilvie/encrypt-bundle, and the console command that emits the reporting output. Those three concepts (classify → encrypt → report) are the entire value proposition.
2. Don't try to boot it in Laravel. Symfony 3 bundles assume the DependencyInjection component, annotations, and Doctrine. Installing it alongside a modern Laravel app will drag in conflicting Symfony 3 components.
3. First use case to replicate: annotate your Eloquent models (or a config map) with GDPR data categories — identifying which columns hold PII, special-category data, retention periods — then generate a PII inventory report via an Artisan command. That's the fastest win and mirrors what the bundle's reporting command does.

Implementation Patterns

Use the bundle as a design template, then implement natively in Laravel:

• Classification registry. Mirror the bundle's annotation concept with a config file (config/gdpr.php) mapping Model::class => ['column' => ['category' => 'pii', 'retention' => '365d', 'encrypted' => true]]. Add a trait like HasGdprData that reads this map and exposes gdprFields().
• Encryption layer. The bundle delegates encryption to mogilvie/encrypt-bundle (Doctrine DBAL types). In Laravel, replace this with an Eloquent Cast (EncryptedCast) backed by Crypt::encryptString() / decryptString(), or use laravel/framework's built-in encrypted casts. Keep the same contract: the model doesn't know it's encrypted, only the schema map does.
• Reporting command. Rebuild the bundle's report console command as php artisan gdpr:report — iterate the registry, group fields by category, emit CSV/JSON for auditors. This is the pattern the package was designed for.
• Subject access & erasure. Drive Data Subject Access Requests (DSAR) and right-to-be-forgotten workflows from the same registry: a gdpr:export --subject={id} job that pulls from all registered models, and a gdpr:erase job that nulls/anonymizes designated fields.
• Integration tip. If you already use a package like foothing/laravel-gdpr or sourcetoad/laravel-gdpr, the classification map from this bundle's annotations maps cleanly into their config — copy the structure, not the code.

Gotchas and Tips

• No Eloquent support. Everything is Doctrine entities, Doctrine events, and Doctrine subscribers. There's no path to using the encryption or reporting code against Eloquent without rewriting the persistence layer.
• Symfony 3 is archived. The bundle targets PHP 5.5–7.x-era Symfony with annotation-based service definitions. Composer will likely refuse to install it in a Laravel 10/11 project without --ignore-platform-reqs, and even then it won't function.
• Abandonment risk. Last release March 2022, 66 stars, zero dependents. That's a strong signal not to build production compliance on top of it — GDPR code that stops receiving crypto/security updates is worse than no library.
• Encryption is indirect. The bundle doesn't implement crypto itself; it wires into mogilvie/encrypt-bundle. If you were evaluating it for encryption specifically, look at that dependency's status and key-management story (there's no Laravel-equivalent APP_KEY rotation).
• Debugging. If you do attempt an install for evaluation, expect failures in DependencyInjection/Configuration.php and service compiler passes. Check the Resources/config/services.yml to see the intended wiring; that file is the clearest documentation in the repo.
• Extension points don't transfer. The bundle offers annotation extensions and DI compiler passes — both Symfony-specific. The only portable ideas are the data classification schema and the report output shape.
• Practical recommendation. Spend 30 minutes reading the source, then build your own HasGdprData trait + registry + gdpr:report command in Laravel. You'll end up with ~200 lines of maintainable code that actually runs on your stack, versus indefinitely fighting a dead Symfony 3 bundle.