The privacy tools Joomla already has

Under Users, Privacy sits a small component built for exactly the requests the GDPR gives people the right to make.

What is in it

• A dashboard showing outstanding requests and how your privacy setup is configured.
• Information requests, which are export or removal requests tied to an email address.
• Consents, a log of who agreed to what and when.

How a request runs

A request is created for an email address, either by you or through a front-end form. The address gets a confirmation mail, because otherwise anyone could ask for anyone else's data. Once confirmed, you can produce an export or carry out a removal.

The export is an XML file assembled from every extension that has a privacy plugin. That last part matters: Joomla can only export what something told it about. A third party component holding personal data without a privacy plugin will be missing from the export, and you will not be warned.

Consents

The System - Privacy Consent plugin asks users to agree to your privacy policy and records it, with a date, an expiry, and a re-request when it lapses. If you have registered users, this is a lot easier than reconstructing consent later from memory.

Setting it up before you need it

• Enable the privacy plugins for the components you use.
• Write a privacy policy page and point the consent plugin at it.
• Do one export of your own account, so you find out what is missing while it is still a drill.

What it does not cover

This handles the data inside Joomla. Your analytics, your mailing list, the form submissions that get emailed and never stored, the backups sitting on another server: none of that is in the component. A removal request covers those too, and only you know where they are.