Users can request and receive a copy of all personal data held about them

GDPR Art. 15 grants every EU data subject the right to receive a copy of all personal data held about them, within 30 days of requesting it. An application with no data export feature and no DSAR process is not compliant — not having a formal process is itself a violation, regardless of whether any user has actually made a request. When a subject access request does arrive (and they will, especially as GDPR awareness grows), scrambling to manually assemble a data export from multiple tables is both error-prone and legally risky. Incomplete exports — for example, returning profile fields but omitting activity history or consent records — also violate Art. 15.

Implement a self-service data export endpoint in app/api/user/export/route.ts that gathers all personal data held about the authenticated user.

export async function GET() {
  const session = await getServerSession()
  if (!session?.user?.id) return new Response('Unauthorized', { status: 401 })

  const userId = session.user.id
  const [profile, activity, purchases, consents] = await Promise.all([
    db.user.findUnique({ where: { id: userId }, select: { id: true, email: true, name: true, createdAt: true } }),
    db.activityLog.findMany({ where: { userId } }),
    db.order.findMany({ where: { userId }, include: { items: true } }),
    db.consentRecord.findMany({ where: { userId } }),
  ])

  return new Response(JSON.stringify({ _meta: { exportedAt: new Date().toISOString() }, profile, activity, purchases, consents }, null, 2), {
    headers: {
      'Content-Type': 'application/json',
      'Content-Disposition': `attachment; filename="my-data-${Date.now()}.json"`,
    },
  })
}

Add a "Download my data" button in account settings. Log each export request with a timestamp to demonstrate compliance with the 30-day fulfillment requirement per Art. 12(3).