Add DSGVO-required audit logging for all data access and mutation routes #16

New Issue

2026-04-20T09:36:29Z

sharang commented

2026-04-20 09:36:29 +00:00

Problem

DSGVO Articles 5(2), 17, and 20 require a demonstrable audit trail of who accessed or modified personal data and when. This is currently absent:

company_profile_routes.py — DELETE has no audit log
dsr_routes.py — DSR request handling (Art. 17 deletion, Art. 20 portability) is not logged
Compliance control changes, evidence uploads, and VVT modifications are unlogged

As a DSGVO compliance platform, this is a fundamental requirement — and an embarrassing gap.

Required Actions

Create compliance/services/audit_service.py with an AuditLogger that writes to a dedicated compliance_audit_log table (append-only, no deletes)
Required fields: tenant_id, user_id, action, resource_type, resource_id, legal_basis, timestamp, ip_address
Wire AuditLogger into every route that:
- Reads personal data (Art. 15 — access)
- Modifies personal data (Art. 16 — rectification)
- Deletes personal data (Art. 17 — erasure)
- Exports personal data (Art. 20 — portability)
The audit log table must be immutable: no UPDATE or DELETE permitted, only INSERT
Expose a GET /api/v1/audit-log endpoint for compliance officers to retrieve the trail (itself audited)

Acceptance Criteria

Every DSR request handling event appears in compliance_audit_log
Company profile deletion generates an audit entry with action=delete, legal_basis, user_id
Depends on: #15 (structlog), #4 (JWT middleware for user_id)

## Problem DSGVO Articles 5(2), 17, and 20 require a demonstrable audit trail of who accessed or modified personal data and when. This is currently absent: - `company_profile_routes.py` — DELETE has no audit log - `dsr_routes.py` — DSR request handling (Art. 17 deletion, Art. 20 portability) is not logged - Compliance control changes, evidence uploads, and VVT modifications are unlogged As a DSGVO compliance platform, this is a fundamental requirement — and an embarrassing gap. ## Required Actions 1. Create `compliance/services/audit_service.py` with an `AuditLogger` that writes to a dedicated `compliance_audit_log` table (append-only, no deletes) 2. Required fields: `tenant_id`, `user_id`, `action`, `resource_type`, `resource_id`, `legal_basis`, `timestamp`, `ip_address` 3. Wire `AuditLogger` into every route that: - Reads personal data (Art. 15 — access) - Modifies personal data (Art. 16 — rectification) - Deletes personal data (Art. 17 — erasure) - Exports personal data (Art. 20 — portability) 4. The audit log table must be immutable: no UPDATE or DELETE permitted, only INSERT 5. Expose a `GET /api/v1/audit-log` endpoint for compliance officers to retrieve the trail (itself audited) ## Acceptance Criteria - Every DSR request handling event appears in `compliance_audit_log` - Company profile deletion generates an audit entry with `action=delete`, `legal_basis`, `user_id` - Depends on: #15 (structlog), #4 (JWT middleware for user_id)

sharang added this to the M3: Observability & Audit Logging milestone 2026-04-20 09:36:29 +00:00

sharang added the security severity: high observability labels 2026-04-20 09:36:29 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Benjamin_Boenisch/breakpilot-compliance#16