Package Exports

purposize

This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (purposize) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.

Readme

Purposize

Purposize is a sequelize plugin to help with technically enforcing purpose limitation.

The European General Data Protection Regulation (GDPR) forces the "controller" to explicitly specify purposes for collection, processing and storing personal data. This tool is designed to technically implement the concept of purpose limitation (GDPR Art. 5(1b)) and to help with provable compliance.

PURPOSIZE IS STILL WORK IN PROGRESS

Getting started

Install purposize using npm i purposize
Extend sequelize instance using purposize.init(sequelize)
Define your own models
Use isPersonalData: true to mark data fields as personal data
Sync your models to the DB using sequelize.sync()
Load purposes specification from .yml file using purposize.loadPurposes(filePath)

const Sequelize = require('sequelize')
const purposize = require('purposize')

const sequelize = new Sequelize(...)
purposize.init(sequelize)

sequelize.define('customers', {
  eMail: {
    type: Sequelize.STRING,
    isPersonalData: true
  },
  postalAddress: {
    type: Sequelize.STRING,
    isPersonalData: true
  },
  unfulfilledOrders: {
    type: Sequelize.INTEGER
  }
})
sequelize.sync()
purposize.loadPurposes('./purposes.yml')

Purpose specification

Explanation of keys

Key Name	Explanation
purposes	List of all purposes
name	Name of the purpose
relevantFields	Specifies the data fields that are relevant to the specific purpose for each table. Make sure that the table name corresponds to your sequelize model name and the field names correspond to your column names (data fields in your model).
retentionPeriod	Specifies the maximum storage duration for the data fields linked to this purpose. Storage duration must be a number and is treated as days. Default is `-1` which means the data is stored infinitly. After the retention period has expired the data will automatically be deleted!
loggingLevel	Specifies which database interactions should be logged. Must be one of the following values: `ACCESS`, `CHANGE` or `ALL`. See logging level specification for more details. Default is `NONE`.
compatibleWith	Specifies all the other purposes this specific purpose is compatible with

Logging Levels

We have specified the following logging levels

Logging level	Explanation
`ACCESS`	A log entry is only created whenever data is accessed for the specific purpose
`CHANGE`	A log entry is created only when the specific purpose for a certain data item has been added or removed
`ALL`	A log entry is created for every interaction connected to the specific purpose.
`NONE`	No log entries are made for the specific purpose (Default)

Example

# purposes.yml

purposes:
- name: NEWSLETTER
  relevantFields:
    customers:
      - eMail
  loggingLevel: CHANGE
- name: ORDER
  relevantFields:
    customers:
      - eMail
      - postalAddress
  retentionPeriod: 60 
  loggingLevel: ACCESS
  compatibleWith:
    - MONTHLY_DELIVERY
- name: FULFILLMENT
  relevantFields:
    customers:
      - postalAddress
  compatibleWith:
    - ORDER
- name: MONTHLY_DELIVERY
  relevantFields:
    customers:
      - eMail
      - postalAddress
  loggingLevel: CHANGE