Authenticated users can download all personal data in portable format

GDPR Art. 20 gives data subjects the right to receive their personal data in a structured, commonly used, machine-readable format and to transmit it to another controller. CCPA §1798.110 and LGPD Art. 18 impose equivalent portability rights. Without a working data export endpoint, you cannot fulfill these rights — which means any user who files a data portability request triggers a regulatory obligation you cannot meet programmatically. The practical consequence is manual database queries under time pressure, which introduces error risk and compliance delay. This is also a competitive signal: users who can export their data are less anxious about vendor lock-in.

Create an authenticated export endpoint at app/api/user/export/route.ts that gathers all user data and returns it as a downloadable JSON file.

// app/api/user/export/route.ts
import { getServerSession } from 'next-auth'
import { db } from '@/lib/db'

export async function GET() {
  const session = await getServerSession()
  if (!session?.user?.id) return new Response('Unauthorized', { status: 401 })

  const userId = session.user.id
  const [profile, activity, purchases] = await Promise.all([
    db.user.findUnique({ where: { id: userId },
      select: { id: true, email: true, name: true, createdAt: true } }),
    db.activityLog.findMany({ where: { userId }, orderBy: { createdAt: 'desc' } }),
    db.order.findMany({ where: { userId }, include: { items: true } }),
  ])

  return new Response(JSON.stringify({ exportedAt: new Date().toISOString(), profile, activity, purchases }, null, 2), {
    headers: {
      'Content-Type': 'application/json',
      'Content-Disposition': `attachment; filename="my-data-${userId}.json"`,
    },
  })
}

Add a "Download my data" button to the user settings page. Rate-limit the endpoint to prevent abuse (e.g., one export per 24 hours per user).