---
name: pdpa-data-export
description: Implement a PDPA/GDPR data-subject access request (DSAR) export. Use when a user requests their data.
---

# Skill: PDPA Data Export (DSAR)

## When to use

A data subject requests a copy of their personal data (PDPA §30 / GDPR Art. 15).

## Steps

1. Identify every table holding the subject's PII (users, documents, audit_logs, approvals, ...).
2. Collect into a structured export (JSON + human-readable PDF) scoped to that `userId`/`tenantId`.
3. Deliver via a short-expiry signed URL; require re-authentication to download.
4. Log the DSAR in `audit_logs` (`action: 'pdpa.export'`).

## Gotchas

- Include data in related tables (audit, documents) — not just the `users` row.
- Don't leak **other** subjects' PII in shared records (redact co-parties in approvals/audit).
- The export link must expire fast (≤ 1 hour) and be single-use.
- Reference `docs/compliance/dsar-runbook.md` for the legal SLA (respond within 30 days).
- Record who requested + who fulfilled.

## Validation

Export covers all PII tables; co-parties redacted; link expires; DSAR audited; matches `data-classification.md`.
