# Personal data

**Partly built.** Missing: exporting a person's data, `privacy:`, jadpo privacy requests and most of the report. See [What is built](/docs/personal-data-built.md).

Your app says which data is about a person, and Jadpo does the rest: it
exports that data when the person asks for a copy, erases it when they ask
to be forgotten, deletes it when its time is up, and reports where it
lives. The aim is that requests under GDPR, UK GDPR and CCPA/CPRA work out
of the box. Built so far: `person: true`, the check that erasure can find
every field marked `personal:`, [retention](/docs/retention.md), which deletes
data when its time is up, and [erasure](/docs/erasure.md) of a person's records in
their store, the bytes of their files included and their own record kept
field by field where it must be. `personal:` is also read for
[the AI page's](/docs/safety-and-privacy.md#personal-data-sent-to-a-model) check of what
reaches a model, and [the report](/docs/the-personal-data-report.md) lists every
connection and host personal data reaches. Nothing exports personal data
yet, and the report doesn't yet list the rest of what it will, so an app
on this compiler does those itself. `User.export` is
`toolchain.not_built_yet` where you write it, and so is any retention or
erasure this compiler can't carry out in full, so none can be mistaken
for working ([What is built](/docs/personal-data-built.md)).

The law asks a few things of an app:

- Keep only the personal data you need, for as long as you need it (GDPR
  Article 5).
- Give a person a copy of everything you hold about them, in a
  machine-readable form, within a month (Articles 12, 15 and 20).
- Delete it when they ask, unless the law makes you keep some of it, such
  as invoices (Article 17).
- Build this in from the start (Article 25), keep a record of what you
  hold and why (Article 30), and protect it (Article 32).

CCPA/CPRA gives Californians the same rights to know and to delete. Each of
these needs the app to know which data is personal and whose it is. That
is the one fact Jadpo asks you to write down.

| Capability | What you write | What the compiler does | Built yet |
|---|---|---|---|
| Marking | `personal:` on a field; nothing on an `Email`, a `PhoneNumber`, a name or a `PostalAddress`, which are personal data already | Hashes it in logs, lists it in the report | Partly: read for the AI check and the report's connections, and checked that erasure can find it; nothing hashes it |
| The person | `person: true` on an entity | Finds every record that belongs to them | Yes |
| Erasure | `erase:` on references it can't work out | Generates `User.erase(id)` across every store and cache | Partly: in the person's store, files' bytes and the person's own record kept field by field included; not yet another store |
| Export | nothing | Generates `User.export(id)` | No: `toolchain.not_built_yet` |
| Retention | `retention:` on a field or entity | Clears or deletes it when the time is up | Partly: not yet on an event |
| Report | nothing | Writes `build/report/personal-data.md` | Partly: every connection and host personal data reaches |

| Page | What it covers |
|---|---|
| [Marking personal fields](/docs/marking-personal-fields.md) | A field that identifies or describes a person says so in its block, with `personal:` and one category from a fixed list. |
| [The person](/docs/person-entities.md) | An entity that represents a person says `person: true`. |
| [Encrypted fields](/docs/encrypted-fields.md) | An entity field can be stored encrypted. |
| [Retention](/docs/retention.md) | Personal data needs an end date: GDPR's storage limitation means you keep it only as long as you need it. |
| [Erasure](/docs/erasure.md) | Erasing a person is a generated operation, `User.erase(user_id)`. |
| [Erasure at providers](/docs/erasure-at-providers.md) | When your app sends a person's data to another company, such as a payment provider, erasing the person also asks that provider to erase them. |
| [Export](/docs/personal-data-export.md) ○ not built | `User.export(user_id)` returns everything held about a person, as JSON, one list per entity. |
| [Data requests](/docs/data-requests.md) ○ not built | `privacy:` in `app.jadpo` turns on generated routes for a person's requests to export or erase their data. |
| [Access records](/docs/access-records.md) | Every export and erasure is recorded: who asked, for which person's `id`, and when, never the values. |
| [Where data is stored](/docs/where-data-is-stored.md) | Each store is one database in one place. |
| [The personal-data report](/docs/the-personal-data-report.md) | `jadpo check` writes `build/report/personal-data.md` and a `.json` twin, in the same form as its other reports (The suggestions report). |
| [What this does not cover](/docs/what-this-does-not-cover.md) | The report says plainly what Jadpo covers and what it doesn't. |

[What is built](/docs/personal-data-built.md) says which of this works today.

## Details

The exact rules, for when you hit an edge case.

| Page | What it covers |
|---|---|
| [What the compiler checks](/docs/personal-data-checks.md) | What the compiler refuses about personal data, such as a marked field nothing reads. |