README

EU General Data Protection Regulation (GDPR) Compliance Extension

Overview

Nexus\GDPR extends Nexus\DataPrivacy with EU-specific compliance requirements:

• 30-day deadline for Data Subject Access Requests (DSARs)
• 72-hour breach notification to supervisory authority
• Specific lawful basis requirements (Article 6)
• Special category data handling (Article 9)
• Data transfer rules for third countries

Installation

composer require azaharizaman/nexus-gdpr

Key Features

1. GDPR Deadline Enforcement

use Nexus\GDPR\Services\GdprComplianceService;
use Nexus\DataPrivacy\ValueObjects\DataSubjectRequest;

$service = new GdprComplianceService($requestManager);

// Get deadline for DSAR (30 calendar days)
$deadline = $service->calculateDeadline($request);

// Check if extension is allowed (up to 2 months for complex requests)
$canExtend = $service->canExtendDeadline($request);

2. Breach Notification Deadlines

use Nexus\GDPR\Services\GdprBreachService;

$service = new GdprBreachService($breachManager);

// Calculate 72-hour notification deadline
$deadline = $service->getNotificationDeadline($breach);

// Check if notification is overdue
$isOverdue = $service->isNotificationOverdue($breach);

3. Lawful Basis Validation

use Nexus\GDPR\Services\LawfulBasisValidator;
use Nexus\DataPrivacy\Enums\LawfulBasisType;

$validator = new LawfulBasisValidator();

// Validate processing activity has valid lawful basis
$isValid = $validator->validate($processingActivity);

// Check if consent is required for purpose
$needsConsent = $validator->requiresConsent(LawfulBasisType::CONSENT);

GDPR-Specific Deadlines

Architecture

This package extends Nexus\DataPrivacy without modifying it:

Nexus\GDPR
├── Services/
│   ├── GdprComplianceService    # Deadline calculations
│   ├── GdprBreachService        # 72-hour notification
│   └── LawfulBasisValidator     # Article 6 validation
├── ValueObjects/
│   └── GdprDeadline             # Deadline with extension rules
└── Enums/
    └── GdprLawfulBasis          # GDPR-specific bases

Usage with DataPrivacy

// Register GDPR-specific handlers
$registry = new RequestHandlerRegistry();
$registry->register(new GdprAccessRequestHandler($gdprService));

// Validate GDPR compliance
$complianceService->validateGdprCompliance($request);

License

MIT License