Provenance queryable for compliance lookups

GDPR Art. 30 requires a Records of Processing Activities identifying each category of data subjects and the source of their data. Art. 17 (right to erasure) requires that you can efficiently locate and delete all records from a specific source when that source becomes non-compliant or a data subject invokes their rights. Without an index on source_id, bulk lookups require full table scans that become prohibitively slow at scale. CCPA §1798.100 adds a parallel right to know which business collected the personal information and from what source.

Add indexes on both source_id and source_type, then expose a compliance query function or admin endpoint that retrieves all contacts for a given source.

CREATE INDEX idx_contacts_source_id   ON contacts (source_id);
CREATE INDEX idx_contacts_source_type ON contacts (source_type);

// src/lib/compliance/lookup.ts
export async function getContactsBySource(sourceId: string) {
  return db.contacts.findMany({
    where:  { source_id: sourceId },
    select: { id: true, email: true, acquired_at: true, source_type: true },
    orderBy: { acquired_at: 'desc' },
  })
}

Surface this function in an admin panel so operations teams can run source-based erasure requests without direct database access.