Purposize is a sequelize plugin to help with technically enforcing purpose limitation.
The European General Data Protection Regulation (GDPR) forces the "controller" to explicitly specify purposes for collecting, processing and storing personal data. This tool is designed to technically implement the concept of purpose limitation (GDPR Art. 5(1b)) and to help with provable compliance.
PURPOSIZE IS STILL WORK IN PROGRESS
- Install purposize using
npm i purposize
- Extend sequelize instance using
- Define your own models
isPersonalData: trueto mark data fields as personal data
- Sync your models to the DB using
- Load purposes specification from
const Sequelize =const purposize =const sequelize = ...purposizeconst Customer = sequelizeawait sequelizeawait purposize
When creating instances that should contain personal data you must specify a purpose within the
options object using the
purpose key. The purpose may either be a string or an array of strings.
The personal data fields that you want to store must match with the relevant fields from your
When specifying only non-personal attributes the purpose field can be omitted.
The returned instance only contains non-personal attributes
The reason is to prevent any data leaks. Furthermore, every access of personal data must be bound to one specific purpose!
const alice = await Customer// Keep in mind: only non-personal data is returned!// alice.eMail and alice.postalAddress will be undefinedconst bob = await Customer// No purpose needed since unfulfilledOrders is a non-personal attribute
Querying works as usual with the exeception that you have to provide a purpose when wanting to retrieve personal data. When adding personal data fields to the
attributes array (
SELECT statement) or
where object (
WHERE statement) you must provide a purpose that legitimizes the access of those personal data fields. The purpose in queries is specified using the
purpose key and must be of type
The returned result may contain instances that have been stored for exactly the specified purpose but also compatible purposes. Every instance only contains all non-personal attributes together with the legitimized personal attributes. All other personal attributes that are not legitimized by the specified purpose are stripped out and are not returned.
When no purpose is specified, the query result only contains non-personal data.
const result = await Customer// Result contains instances that have been stored for the purpose NEWSLETTER or other compatible purposes.// Every instance contains all non-personal attributes (in this example: unfulfilledOrders) together with the legitimized personal data attributes (in this example: eMail).
When updating already existing attributes you can simply call the
update method with no further options.
When wanting to add a new personal data field to an instance you must again specify a purpose that legitimizes the storage. It works the same as creating an instance. You need to set the
purpose key within the
The returned instance only contains non-personal attributes
// Adding no personal data fieldsconst alice = await CustomeraliceeMail = "firstname.lastname@example.org"alicepostalAddress = "9876 Cheapcity"await alice// Adding new personal data fieldsconst bob = await CustomerbobeMail = "email@example.com"await bob// Updating also works through the instance.update methodawait bob
# purposes.ymlpurposes:- name: NEWSLETTERrelevantFields:customers:loggingLevel: CHANGE- name: ORDERrelevantFields:customers:- postalAddressretentionPeriod: 60loggingLevel: ACCESScompatibleWith:- MONTHLY_DELIVERY- name: FULFILLMENTrelevantFields:customers:- postalAddresscompatibleWith:- ORDER- name: MONTHLY_DELIVERYrelevantFields:customers:- postalAddressloggingLevel: CHANGE
Explanation of keys
|purposes||List of all purposes|
|name||Name of the purpose|
|relevantFields||Specifies the data fields that are relevant to the specific purpose for each table. Make sure that the key for each table corresponds to the actual table name (NOT your sequelize model name!) and the field names correspond to the actual column names (data fields in your sequelize model).|
|retentionPeriod||Specifies the maximum storage duration for the data fields linked to this purpose. Storage duration must be a number and is treated as days. Default is
After the retention period has expired the personal data attributes will automatically be deleted!
|loggingLevel||Specifies which database interactions should be logged. Must be one of the following values:
|compatibleWith||Specifies all the other purposes this specific purpose is compatible with.|
We have specified the following logging levels
||A log entry is only created whenever data is accessed for the specific purpose|
||A log entry is created only when the specific purpose for a certain data item has been added or removed|
||A log entry is created for every interaction connected to the specific purpose.|
||No log entries are made for the specific purpose (Default)|
You can initialize purposize with some options.
const Sequelize =const purposize =const sequelize = ...purposize
||Determines how often purposize automatically checks for data instances whose retention period for a specific purpose has expired. As soon as purposize detects outdated storage purposes, the personal data attributes linked to the outdated purpose are deleted (if there is no other purpose that legitimizes the storage of the personal data attributes).
Must be a number given in milliseconds and must be greater than 1 hour (3600000 ms).
||Determines if purposize creates log entries. Must be a boolean.||
||Custom logging function that can be provided. Receives the log string as input. Must be a function.||
New Methods on Instances
const carl = await Customerawait carl
- instance.removePurpose (Be careful: This method deletes unnecessary personal data fields that are not legitimized by any other purpose!)
const carl = await Customerawait carl// This will delete the eMail attribute on carl if there is no other purpose that legitimizes the storage of carl's email