CCPA data export in machine-readable format

CCPA §1798.100 and §1798.110 grant California residents the right to know what personal information a business has collected about them and to receive it in a portable format. GDPR Article 15 (right of access) and Article 20 (right to data portability) impose equivalent obligations for EU residents. Without a data export path, every access request requires a manual database query — slow, expensive, and inconsistent across requests. An export that only returns the contact profile while omitting consent history, engagement events, and form submissions is an incomplete response to a legal right, leaving the business exposed to regulatory action.

Implement a GET /api/admin/contacts/:id/export endpoint backed by a service that aggregates all PII categories in one call:

// src/lib/compliance/export.ts
export async function exportContactData(contactId: string): Promise<ContactDataExport> {
  const [contact, consentHistory, emailEvents, formSubmissions] = await Promise.all([
    db.contact.findUnique({ where: { id: contactId } }),
    db.consentRecord.findMany({ where: { contactId }, orderBy: { createdAt: 'asc' } }),
    db.emailEvent.findMany({ where: { contactId }, orderBy: { occurredAt: 'asc' } }),
    db.formSubmission.findMany({ where: { contactId }, orderBy: { submittedAt: 'asc' } }),
  ])

  return {
    exportedAt: new Date().toISOString(),
    contactId,
    profile: contact,
    consentHistory,
    emailEngagement: emailEvents,
    formSubmissions,
  }
}

Verify the export is scoped to one contact — run a query in staging that confirms no other contact's records appear in the response. Protect the endpoint with admin-only authentication.