Is Drupal ready for GDPR compliance?

Question

Is Drupal is ready for GDPR compliance?

Is there any patch or extension they need to apply for GDPR ready for all EU countries as this is the law for EU countries the come in effect on may 25, 2018.

Answer 1

I'm one of the maintainers of the GDPR module.

First of all I'd like to call your attention to the fact that GDPR is not an IT-related question solely. Personally I'd suggest stop considering "adding an extension to my CMS will make me legally good". That's not that easy. You, or the owner of the Drupal website you maintain/develop on their behalf should transform their organization/company's inner workflow of dealing with personal data.

However, the GDPR module indeed can be a perfect starting point to install, go through on its checklist points and after you read them carefully, hopefully will realize that you're just stepped on the path of becoming GDPR-compliant, but a big portion of tasks ahead probably falls out of the scope of configuring Drupal.

Answer 2

I don't think Drupal is "ready" for the General Data Protection Regulation (GDPR), at least not yet.

However, help seems to be on its way ... go checkout what the General Data Protection Regulation module will be (repeat: will be) about. From its project page:

This module gives end-user visibility to the data stored about himself/herself and aims to help site admins follows the guidelines and legislation set by the EU.

Current features

• Checklist for site admin (recommend modules like cookie consent, check if there is privacy policy page etc).
• Drush command (drush gdpr-sql-dump) to obfuscate data. Primary goal is to prevent developers from accessing user data.

Future features

• Allow logged in user to see all raw data stored about himself/herself (user entity).
• Allow user to initiate “forget me” action from site admins.
• More items and recommendations to checklist.
• Make sure user can rectify all data about himself/herself.
• Allow user to remove the account (content is not removed).
• Make API for other contrib modules to announce user data stored.

There is a release in the pipeline for both D7 and D8, though so far only alpha versions ... Fingers crossed to see what will happen by the GDPR's Enforcement date, i.e 25 May 2018.

Other GDPR related modules

Some other modules in the Drupal pipeline (only alfa/beta releases today), which may give you an idea about the areas of a Drupal site that may need attention, including quotes from their project pages (there are more GDPR related "sandboxes" also):

• General Data Protection Regulation Compliance

  Basic GDPR Compliance use cases:

  • Form checkboxes
  • Pop-up alert
  • Policy Page

• GDPR Consent

  ... collects GDPR Data processing consent from logged-in users using the site.

• Commerce GDPR

  Adds data anonimization features so the data will still be available for statistical and history purposes but will not allow to identify a user and the store will comply with the GDPR directive.

• Mask User Data

  ... mask all the current data in your database related to the users.

  ... could be really useful when considering the new GDPR legislation, as all the user data could easily be masked in development/local copies.

• Cookiebot - Cookie consent, Cookie monitoring and Cookie control

  Drupal integration for the third party Cookiebot service.

  Cookiebot helps make your use of cookies and online tracking GDPR and ePR compliant. This module exposes this third party functionality to Drupal. It enables their Cookie banner/consent manager and allows you to place the automatically updated cookie declaration on a given node page or via a block. A free subscription is available for small sites and bigger sites can evaluate this functionality using their free trial. More info about Cookiebot.

  Many sites now offer more sophisticated cookie controls to the visitor. More sophisticated than perhaps the compared with the eu_cookie_compliance module, whereby various cookie types/functions are displayed and can be managed by the visitor. This Drupal Contrib module cookiebot is a general solution used to provide this functionality in Drupal 7 and 8 sites. I would imagine that some Drupal site developers have made their own, but this module offers the advantage of a module whereby it can be reused in several sites, also not re-inventing the wheel.

  However the downside is that it is subscription-based. A standalone non-subscription self-contained solution if existing, would be a compelling choice.

Make no mistake

• Don't assume that if you've enabled the GDPR module, you're done ...
• GDPR will apply to any Drupal site that deals with users, site visitors, etc, who are from the EU (which public site does not do so?) ...

Infrastructure and data maps

• Covering GDPR issues is not just about the application itself (the Drupal site) but also the platform that it runs on. As part of reaching the GDPR compliance process, a "Datamap" is drawn up to identify all the systems where the sensitive user data will flow. Also bear in mind what happens if the application is moved to another platform, would there be the possibility of residual data left on the former platform? For example, here is an answer on stackoverflow.com regarding configuring the file system path of Docker-based setups to support the approach to run a Docker-based web application inside an encrypted filesystem so that such residual data is never left behind.

Read more

• How to make your Drupal site GDPR compliant?
• Drupal and GDPR (General Data Protection Regulation).
• The Drupal Group Legal contains an interesting/ongoing discussion, located at Community discussion on how to assist Drupal site owners towards GDPR compliance?

Answer 3

Drupal is not ready and even if the Drupal project on GDPR is finished it is not enough to comply with GDPR. Every Organization has to do their due dilligence on that. Time is running out.