Is Drupal is ready for GDPR compliance?
Is there any patch or extension they need to apply for GDPR ready for all EU countries as this is the law for EU countries the come in effect on may 25, 2018.
Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.Sign up to join this community
I'm one of the maintainers of the GDPR module.
First of all I'd like to call your attention to the fact that GDPR is not an IT-related question solely. Personally I'd suggest stop considering "adding an extension to my CMS will make me legally good". That's not that easy. You, or the owner of the Drupal website you maintain/develop on their behalf should transform their organization/company's inner workflow of dealing with personal data.
However, the GDPR module indeed can be a perfect starting point to install, go through on its checklist points and after you read them carefully, hopefully will realize that you're just stepped on the path of becoming GDPR-compliant, but a big portion of tasks ahead probably falls out of the scope of configuring Drupal.
I don't think Drupal is "ready" for the General Data Protection Regulation (GDPR), at least not yet.
However, help seems to be on its way ... go checkout what the General Data Protection Regulation module will be (repeat: will be) about. From its project page:
This module gives end-user visibility to the data stored about himself/herself and aims to help site admins follows the guidelines and legislation set by the EU.
- Drush command (drush gdpr-sql-dump) to obfuscate data. Primary goal is to prevent developers from accessing user data.
- Allow logged in user to see all raw data stored about himself/herself (user entity).
- Allow user to initiate “forget me” action from site admins.
- More items and recommendations to checklist.
- Make sure user can rectify all data about himself/herself.
- Allow user to remove the account (content is not removed).
- Make API for other contrib modules to announce user data stored.
There is a release in the pipeline for both D7 and D8, though so far only alpha versions ... Fingers crossed to see what will happen by the GDPR's Enforcement date, i.e 25 May 2018.
Some other modules in the Drupal pipeline (only alfa/beta releases today), which may give you an idea about the areas of a Drupal site that may need attention, including quotes from their project pages (there are more GDPR related "sandboxes" also):
Basic GDPR Compliance use cases:
- Form checkboxes
- Pop-up alert
- Policy Page
... collects GDPR Data processing consent from logged-in users using the site.
Adds data anonimization features so the data will still be available for statistical and history purposes but will not allow to identify a user and the store will comply with the GDPR directive.
... mask all the current data in your database related to the users.
... could be really useful when considering the new GDPR legislation, as all the user data could easily be masked in development/local copies.
Drupal integration for the third party Cookiebot service.
Many sites now offer more sophisticated cookie controls to the visitor. More sophisticated than perhaps the compared with the eu_cookie_compliance module, whereby various cookie types/functions are displayed and can be managed by the visitor. This Drupal Contrib module cookiebot is a general solution used to provide this functionality in Drupal 7 and 8 sites. I would imagine that some Drupal site developers have made their own, but this module offers the advantage of a module whereby it can be reused in several sites, also not re-inventing the wheel.
However the downside is that it is subscription-based. A standalone non-subscription self-contained solution if existing, would be a compelling choice.
Drupal is not ready and even if the Drupal project on GDPR is finished it is not enough to comply with GDPR. Every Organization has to do their due dilligence on that. Time is running out.