Weave Code
Gdpr Bundle Laravel Package
superbrave/gdpr-bundle
Symfony bundle for GDPR compliance that helps anonymize personal data in Doctrine entities and automate right-to-be-forgotten workflows. Configure fields, run console commands, and keep user records compliant without custom cleanup code.
A Symfony bundle for using entity annotations according to GDPR requirements and anonymizing/exporting data
Frequently asked questions about Gdpr Bundle
- What does superbrave/gdpr-bundle actually do?
- It is a Symfony bundle that lets you tag personal data on Doctrine entity properties with annotations, then derives anonymization and export behavior from that metadata. You configure which fields are personal, run console commands, and the bundle handles right-to-be-forgotten anonymization and data export without custom cleanup code. It is a declarative data-classification layer plus a set of anonymizer strategies such as nullify, hash, redact, and pseudonymize.
- Can I use superbrave/gdpr-bundle in a Laravel application?
- Not as a drop-in dependency. The package is a Symfony bundle that hooks into the Symfony DI container, kernel bundle registration, and Doctrine ORM metadata and annotation readers, so there is no natural seam in an Eloquent-based Laravel stack. There is no service provider, no config publishing, no Eloquent trait, and no Laravel command or queue integration. Installing it would mean pulling Doctrine ORM, doctrine/annotations, and Symfony HTTP kernel components into your app, which is disproportionate for most Laravel projects.
- Which Laravel and PHP versions are supported by this package?
- Laravel is not supported at all, since the package targets Symfony and Doctrine rather than Eloquent. The last release was February 2020, so it assumes roughly PHP 7.x, Symfony 4 or 5, and Doctrine ORM 2.x. Expect incompatibilities with PHP 8.1 and above, Symfony 6 and 7, and Doctrine ORM 3.x, which changed the metadata APIs this bundle depends on.
- Is superbrave/gdpr-bundle still maintained?
- The project shows strong signs of being abandoned: the last release was February 2020 and the repository has around 11 stars, implying a single maintainer or no active maintenance. There is no security advisory channel and no upgrade path for modern PHP, Symfony, or Doctrine versions. Treat it as a reference implementation rather than a dependency you would ship to production.
- How does the anonymization of personal data work in this bundle?
- You annotate Doctrine entity properties to mark them as personal data, and the bundle reads that metadata to decide what to erase or export. Anonymizer strategies then apply transformations such as setting fields to null, hashing, redacting, or deterministic pseudonymization. The key risk is that classification is annotation-based and fails silently: an unannotated column is simply never erased or exported, and nobody notices until a subject access request or an audit.
- What is the best Laravel alternative to this GDPR bundle?
- Build or adopt a Laravel-native equivalent: a trait plus PHP 8 attributes on Eloquent models, an anonymizer registry, and an export command or queued job. The transferable ideas from this bundle are the personal-data annotation taxonomy, the anonymizer strategy set, and the export serializer concept, all of which map cleanly onto Eloquent casts and jobs. Porting the non-obvious algorithms, such as deterministic pseudonymization and relational consistency during erasure, is usually a small, contained effort.
- How do I port the anonymizer and exporter concepts to Eloquent?
- Start by inventorying and classifying PII at the schema level, then replace Doctrine annotations with PHP 8 attributes on your models and read them via reflection. Implement an anonymizer registry that maps attribute values to strategies like nullify, hash, redact, and pseudonymize, and drive it from a queued job or artisan command. Where the bundle's algorithms are non-trivial, such as keeping foreign-key relationships consistent during erasure, port the logic rather than reinventing it.
- What are the compliance risks of using an unmaintained GDPR library?
- GDPR logic encodes legal decisions, so a stale library effectively freezes old retention and anonymization policy into your codebase. Silent classification failures are the bigger danger: missing annotations mean data that should have been erased or exported simply was not. That creates compliance exposure that normal dependency-risk scoring understates, especially if nobody owns the classification schema and reviews it with your DPO.
- Does this bundle cover DSAR exports and the right to erasure?
- It meaningfully covers two jobs: data subject access request exports and right-to-erasure anonymization of tagged entity fields. It does not provide data mapping or ROPA generation, and it does not enforce retention schedules. Decide which of those jobs you actually need before evaluating the package, because the scope is narrower than general GDPR compliance tooling.
- How should I test a GDPR anonymization implementation before production?
- Write tests that assert every column flagged as personal is either erased or exported, and add a coverage check that fails when a model has unclassified fields, so classification cannot silently drift. Verify relational consistency after erasure, including foreign keys and audit tables, and check that pseudonymized values remain deterministic across runs if you rely on joins. Run the suite against a production-shaped schema, since annotation or attribute gaps only show up where real columns exist.
Weaver
How can I help you explore Laravel packages today?