Compliance evidence exportable for legal review

GDPR Article 5(2) accountability and Article 30 records-of-processing requirements both assume that a controller can produce evidence of compliance on request — but "we have the data in the database" is not an evidence export mechanism. Without admin tooling that joins consent records, audit log entries, and erasure receipts into a coherent timeline, responding to a data protection authority inquiry or a data subject access request requires a bespoke database query every time, introducing inconsistency and delay. ISO 27001:2022 A.5.35 covers evidence of compliance activities. CCPA §1798.185(a)(8) requires businesses to document their data practices in a producible form.

Add a GET /api/admin/contacts/:id/compliance-report endpoint that joins all three compliance data sources in one call:

// src/app/api/admin/contacts/[id]/compliance-report/route.ts
export async function GET(req: Request, { params }: { params: { id: string } }) {
  const [consentRecords, auditLog, erasureLog] = await Promise.all([
    db.consentRecord.findMany({ where: { contactId: params.id }, orderBy: { createdAt: 'asc' } }),
    db.auditLog.findMany({ where: { entityId: { startsWith: params.id } }, orderBy: { createdAt: 'asc' } }),
    db.erasureAuditLog.findMany({ where: { contactId: params.id }, orderBy: { processedAt: 'asc' } }),
  ])

  return Response.json({
    generatedAt: new Date().toISOString(),
    contactId: params.id,
    consentHistory: consentRecords,
    operationalAuditTrail: auditLog,
    erasureRequests: erasureLog,
  })
}

Protect this route with admin-only authentication and log every export to the audit trail itself — an unauthenticated compliance export is itself a data exposure incident.