🔒 GDPR consumer guide — GDPR.md provider authoring + deployment checklist

[PierreBrisorgueil]

Public consumer guide — the downstream deployment recipe lives in the stack, not in tribal knowledge.

Scope — GDPR.md (repo root or docs), referenced from MIGRATIONS.md

• Provider authoring contract: registration fields, idempotency requirement, deterministic anonymization, subject-only export rows (third-party-leak guard), erase result semantics (removed vs retained + message), validate pre-flight, external fail-open semantics.
• Consumer deployment checklist: for each custom module holding personal data — register a provider in its *.init.js → add the init test → add waivers for no-PII collections → run the coverage gate green → wire external processors the project uses → update the privacy policy (retention durations, backup window, processor list) → adopt the restore-replay runbook.
• Recipes (each ~10 lines, generic): dual-axis collection; key-less child documents erased by traversal from the owning provider; denormalized name/string scrub; overriding a stack provider (override:true); external-processor provider.
• Operational annexes: backup stance (bounded rotation window + restore-time re-erasure replay from the ledger + disclose the window), log-retention norm (6-12 months), accounting-data retention ground (Art 17(3)(b)), payment-processor record-keeping note.
• MIGRATIONS.md: breaking-route note (DELETE /api/users removed → /api/users/me/data) + pointer to GDPR.md.

DoD

• Guide self-contained (a consumer can deploy without reading stack internals); concise-markdown style.
• Route migration note in MIGRATIONS.md.
• /verify green (docs lint if applicable).

Depends on: export+erasure controller (documents the shipped behavior).

Created via /dev:issue · contract v2 2026-07-03