Data export generates complete machine-readable archive within 72 hours

GDPR Art. 20 (data portability) and CCPA §1798.100 both require that users receive a complete, machine-readable copy of their data upon request, within defined timeframes. An export that omits message history, follower lists, or activity logs is a partial response that fails compliance. Regulators specifically audit export completeness — the ICO and CNIL have both taken enforcement action against platforms that provided incomplete or unprocessable archives. Beyond compliance, denying users access to their own data creates lock-in and erodes trust.

Build a background job that assembles all user data categories — profile, posts, comments, messages (participant's side only), followers, following, settings, activity logs — into a JSON or ZIP archive, then stores a signed download URL and notifies the user by email. Track export jobs in a data_export_jobs table to enforce the 72-hour SLA.

// src/jobs/generateDataExport.ts
async function generateDataExport(jobId: string) {
  const job = await db.dataExportJob.findUnique({ where: { id: jobId } });
  const [profile, posts, messages, followers] = await Promise.all([
    db.user.findUnique({ where: { id: job.userId } }),
    db.post.findMany({ where: { authorId: job.userId } }),
    db.message.findMany({ where: { OR: [{ senderId: job.userId }, { recipientId: job.userId }] } }),
    db.follow.findMany({ where: { followingId: job.userId } }),
  ]);
  const archive = { profile, posts, messages, followers, exportedAt: new Date().toISOString() };
  const zipPath = await createZip(archive);
  await db.dataExportJob.update({
    where: { id: jobId },
    data: { status: 'completed', completedAt: new Date(), downloadUrl: generateSignedUrl(zipPath) }
  });
}