Introduction

The General Data Protection Regulation is a regulation of the European Union that defines the processing of personal data. In order to comply with this regulation we introduced GDPR handling. This concept describes the GDPR export feature and how customers can customize it. The GDPR export was developed as generic, adaptable and migration-friendly. Fields of persistent objects containing any kind of personal data can be serialized as JSON. When the process is completed the CSR (the administrator) can download the data as a ZIP archive.

Glossary

References

• Concept - Dependency Injection and ObjectGraphs
• Cookbook - GDPR Export Customization (valid to 7.9)
• Guide - GDPR Declaration ICM

Export Overview

The export logic is located in the bc_gdpr cartridge within the f_business component set. The diagram below presents the export algorithm.

1.  Crawl tables and get all data.
2.  Filtrate non-personal data.
3.  Provide data for serialization.
4.  Group data into files.
5.  Combine JSON files in a single ZIP archive.

Filtration of Personal Data

Due to complications with persistent objects and the importance of the data, we offer a filtration logic. The filtration is realized by a custom JsonFilter provided by Jackson.

There are two classes responsible for this logic:

• PropertyFilterGDPRImpl- Added specific logic for filtration, support different scopes for specific table or global- ignorePropertyInTable, ignoreALL.
• PropertyFilterConfigurationProviderGDPRImpl - Declares which properties must be ignored and instance of PropertyFilterGDPRImpl.

@Inject
private PropertyFilterGDPRImpl propertyFilterGDPRImpl;

For a list with all ignored properties, refer to Concept - GDPR Export.

Serialization Preferences

The serialization preferences must be defined in Jackson ObjectMapper. In this project there are declared in MapperBasicConfigSetting. The ObjectMapper has a provider that makes all default settings available to the mapper.

@Inject
@Named("JacksonObjectMapperGDPR")
private ObjectMapper objectMapper;

JacksonObjectMapperGDPR Settings:

Customization

The GDPR feature uses Guice as dependency injection framework and is therefore easy to integrate into our implementation. Guice works with modules and each module provides a declaration of bindings between interfaces and classes. Those bindings are stored in the object graph. To customize the export, you need to know which classes are declared in our API and what they are used for.

The bindings can be overridden via declaration in objectgraph.properties:

global.overrideModules = <YourNamingModule>