Personal data export and account deletion

[ntarocco]

Discussion outcomes during the workshop in Graz in 2026.

Multiple InvenioRDM instances now requires data export for various use cases. Account deletion is also a nice to have feature.

The main use cases for data export is for allowing migration of records from one system to another. Personal data is an extra feature on top.

Record exports

• The user should be able to export their own records from the profile page.
• The community owner should be able to export all the community's record by the settings panel.
• In both cases, the format should be selectable (JSON, Marc, etc...)
• The complex case is when the user wants to export a large number of records, or a large number of files or large files: in this case, the system should prepare the export async, and then inform the user by e-mail with a link for the download. It is unclear how to solve the issue of very large files.
• It is perfectly fine to provide a .zip with all the files.

Personal data

• On top of records, the user should be able to download personal data.

User

• Your account name (account.username)
• Your full name and affiliation (profile.full_name)
• Your email address (account.email)
• Your institutional affiliation (profile.affiliations)
• Your user preferences
  • profile/email visibility (preferences.visibility and email_visibility)
  • language, time zone, notification preferences, profile picture and display preferences
• Your granted quota/limits
• Your historic login information (last login timestamp and login count) (sessions, account.last_login_at, account.current_login_at, account.last_login_ip, account.current_login_ip, laccount.ogin_count)
• Which deposits you have created and records you have published, incl. timestamp
• Which communities you have created and manage, incl. timestamps
• Login/OAuth
  • Your authorized third-party applications (oauth)
  • Your access tokens and developer applications (oauth)
• Session
  • Your browser sessions (sessions)
• Your linked accounts (GitHub, ORCID and OpenAIRE IDs)
• GitHub
  • Your GitHub repositories, releases that you created, and the metadata associated with both of them
• Memberships
  • Which communities you are a member of
  • your role in them
  • your membership visibility
• Invitations
  • Which communities you have been invited to and which invitations you have sent, and the corresponding timestamp with you action.
• Requests
  • Your requests, your comments/assignments/reviews on requests, and actions you perform on requests
  • Your access requests (including email address, name and justification) to restricted/embargoed records

User deletion

In the user profile, we should display a button to delete the account:

• A global config will enable/disable/hide the button, as accounts might not be deleted in institutional context (the account lifecycle is bound to the organization's account)
• Should the user receive a data export by email after triggering the account deletion?
• When deleting the account, we should not allow re-creating an account with the same username or email for security issues (hashing?).
• When deleting a user, there should be a repository configuration that will define if data (e.g. comments/requests) is completely data or only anonymized.