stapel-gdpr
GDPR compliance: staged async data export (Art. 15/20) with status polling and download, account deletion with a cancellable grace period (Art. 17), inactivity closure, retention cleanup, LegalHold (blocks closure/deletion) and ReRegistrationHash, orchestrated through an in-process GDPRProvider registry (stapel_core.gdpr.gdpr_registry) plus comm confirmation (gdpr.section.erased) for remote services.
Part of the Stapel framework — composable Django apps that deploy as a monolith or as microservices without changing module code.
Install
pip install stapel-gdpr
At a glance
| Fact | Value |
|---|---|
| Version | 0.4.2 |
| Python | >=3.11 (3.11, 3.12, 3.13, 3.14) |
| HTTP operations | 7 |
| Config axes | 1 |
| Usage surface | 14 |
| Extension points | 3 |
| Error codes | 51 |
| Fleet dependencies | stapel-core |
Documentation
capabilities.json · llms.txt (for agents)
Quick start
# settings.py
INSTALLED_APPS = [
...
'stapel_gdpr',
]
MIDDLEWARE = [
...
# After authentication: refuses every request of an account being erased,
# whatever a still-valid token claims.
'stapel_gdpr.guards.AccountClosureGuardMiddleware',
]
STAPEL_GDPR = {
# Every store holding personal data. Erasure is only ever reported
# complete when each of these returned a deletion receipt, so an owner
# missing here is a store that quietly keeps the data. `manage.py check`
# fails while this is empty.
'DATA_OWNERS': ['auth', 'profiles', {'name': 'cdn', 'kind': 'remote'}],
'DATA_OWNERS_VERSION': '2026-08-13.1',
# How the user's sessions are revoked at closure. Auto-detected when
# stapel-auth is installed; without any seam, closure is refused rather
# than performed with live tokens left behind.
'SESSION_REVOKER': 'stapel_auth.sessions.services.SessionService.revoke_all',
}
Run manage.py check after wiring: a missing or stale data-owner inventory,
hash rows written outside store_hashes, and every open escape hatch are
reported there rather than discovered in an audit.
Bus events
Emits
| user.deleted | schema | All user PII permanently deleted after grace period. Every package storing user |
| user.deletion_initiated | schema | Account closure started. 30-day grace period begins; account is deactivated. |
| user.export_ready | schema | Data export archive is ready for download. |
| user.sessions_revoked | schema | Closure revoked every session and access JTI of the user. |
License
MIT — see LICENSE.
This page is assembled by stapel-readme from docs/readme.md plus the contract artifacts in docs/. Edit the prose in docs/readme.md; the badges, facts and links above and below it are generated — do not hand-edit README.md.
1 maintainer
Metadata
1 maintainer
Release files for stapel-gdpr 0.4.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| stapel_gdpr-0.4.2.tar.gz | 88.9 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| stapel_gdpr-0.4.2-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 164.2 kB
Release files / stapel_gdpr-0.4.2.tar.gz
| Download URL | stapel_gdpr-0.4.2.tar.gz |
|---|---|
| Size | 88.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
2549770a6eb334010d016b8704598212b5ec606ed13f27113ff0d7c53783d5b3
|
|
BLAKE2b-256 checksum How to use checksums |
6e15555af6740636c4c70e50566ceaeba27ad36d39743787bcb2bc2ef217a1b4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 15, 2026.
Transparency logRelease files / stapel_gdpr-0.4.2-py3-none-any.whl
| Download URL | stapel_gdpr-0.4.2-py3-none-any.whl |
|---|---|
| Size | 75.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
482efad091aa0c6b00539d27d6813c23773eb2999ee704c6f547a35dda0dfb01
|
|
BLAKE2b-256 checksum How to use checksums |
d44834a46cdf66933bdaa5285cc5778beb227f69dd37e2a2132b5b76da6832b4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 15, 2026.
Transparency log
