Compliance Management › Privacy & Data Protection Management

Privacy & Data Protection Management

BC-130.50 Level 2 Cross-Industry 69 providers 140 API surfaces 40 rated strong or better

GDPR/equivalent compliance, data subject rights, privacy by design.

Privacy & Data Protection Management (BC-130.50) is a level-2 business capability under Compliance Management in the Cross-Industry model. The catalog holds 140 API surface(s) from 69 provider(s) that can perform some part of it, 40 of them rated strong or better. Reach is the vendor surface that lands on this capability — it is not a claim about what any particular organisation has deployed.

Where this capability definition comes from. This capability is part of a published business-architecture model that API Evangelist did not author. It is redistributed here under CC-BY-4.0. Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0 Changes: Consolidated from 333 per-L1 YAML files into one JSON; English only (upstream i18n/ omitted); descriptions whitespace-normalised. No capability was added, removed, renamed or re-parented. Source repository · NOTICE and third-party framework attributions

Sub-capabilities

Privacy Programme Governance BC-130.50.10

Privacy framework, DPO function, and accountability arrangements.

no catalog coverage

Records of Processing Management BC-130.50.20

Maintenance of records of processing activities and data flows.

no catalog coverage

Data Protection Impact Assessment BC-130.50.30

DPIAs and privacy-by-design reviews of new processing activities.

no catalog coverage

Data Subject Rights Handling BC-130.50.40

Intake and fulfilment of access, rectification, and erasure requests.

no catalog coverage

Personal Data Breach Management BC-130.50.50

Detection, notification, and remediation of personal data breaches.

no catalog coverage

Providers that reach this capability

Ordered by rating band. Reach means a provider publishes an API surface that can perform some part of this capability — it is not a claim that any particular organisation has deployed it.

Exemplar 18 Complete, well-documented, and agent-ready
Didomiconsents/eventsconsents/proofsmetadatametadata-purpose-regulation-override9 APIs81.0OptimizelyComplianceSubject Access Requests2 APIs80.8Adobe SuiteConsentPrivacy jobsRecord Delete (Work order)3 APIs78.3ListrakForget1 API73.7KlaviyoData Privacy1 API73.6beehiivData Deletion1 API73.1OneTrustApplicationsAssessment ActionsAssessmentsCollection Points33 APIs72.7Adobe CampaignPrivacy1 API72.0GetResponseGDPR Fields1 API71.6AttentivePrivacy Request1 API71.4Google AnalyticsUser DeletionuserDeletion2 APIs70.2UserGemsPrivacy1 API70.1MatomoPrivacyManager1 API70.0MoEngageGDPR1 API69.0StrivacityConsent1 API67.9AppsFlyerProduction1 API67.2Common RoomRight to Be Forgotten1 API67.2QualifiedGDPR1 API66.8
Strong 22 Solid coverage with minor gaps
AdyenErasure1 API66.1NexGen CloudUser Consent1 API65.9ZohoSubjectAccessRequest1 API65.1GongData Privacy1 API64.7ExtoleErasure1 API64.6Microsoft Graphprivacy.subjectRightsRequestsecurity.subjectRightsRequest2 APIs63.5MOLOCOUserDataDeletionRequest1 API63.5SalesloftRequestsRight to Be Forgotten2 APIs63.5PostscriptCompliance1 API62.5ZaiusCompliance1 API60.8GenesysGeneral Data Protection Regulation1 API60.3LiveRampPrivacyRequests1 API60.1Clerk.ioPrivacy1 API58.3ReachdeskGDPR1 API58.2SourcepointGDPR TCF end-user consent statusGDPR TCF vendor listGDPR reporting APIPreferences end-user history6 APIs57.5AmplitudeData AccessData Deletion2 APIs57.3BigCommerceConsent1 API56.4The Trade DeskDeletionOptOut1 API55.1MixpanelDeletionRetrieval2 APIs55.0Observe.AIDSR1 API54.9BigIDDSAR1 API54.7OsanoCollectionsConsent ProfilesConsentsDSAR8 APIs54.4
Developing 23 Usable, with meaningful gaps to close
ObservePointaudits-consent-categoryconsent-categoriescookie-privacy-reporttag-privacy-report4 APIs53.4EverbridgePrivacy Policy1 API53.3JusttData Subjects1 API52.2TranscendConsentData Subject RequestPreferences3 APIs52.2LaterDataSubjectRequest1 API51.6MavrckDataSubjectRequest1 API51.1SocotraCompliance1 API50.9MINEEvidenceSearchPrivacyRightsPublicTickets3 APIs50.6InthConsentSubjects2 APIs49.7American Express Global Business Travelgdpr-controller1 API49.2PimlocMedia1 API49.1Elastic PathPersonal Data Erasure Requests1 API48.9Pendo.ioBulk Deletion (GDPR/CCPA)1 API48.4VTEXData Subject Rights1 API47.1DixaAnonymization1 API46.5AghanimGDPR Requests1 API46.3SurvicatePersonal Data1 API45.0UsercentricsConsentConsent ModeTCF3 APIs44.9SAP Commerce CloudConsents1 API44.0SiteJabberPrivacy1 API43.8TikTokData Portability1 API42.5LiveIntentAPI ReferencesLegacy2 APIs42.1CalendlyData Compliance1 API40.7
Thin 6 Limited public surface area
Bitrix24User Consent1 API38.7ChurnkeyData Subject Requests1 API35.0DriftData Privacy1 API32.1EnvestnetConsents1 API30.4HotjarUser Lookup1 API27.8ForterData Privacy1 API27.6
This page carries no rating. Capabilities are not rated. A capability is a description of what a business does, not a thing a company publishes, so a Kin Score would have nothing to measure.
The edge table is a Pro feature. This page shows which providers and tags reach Privacy & Data Protection Management. The underlying tag → capability edges — each with the quoted fragment of the provider's own OpenAPI that evidences it, a calibrated confidence score, and the contract-provenance gate it passed — are available through the API, along with company-level capability maps. Only edges at confidence ≥ 0.7 with evidence found verbatim in the source contract are published at all.

See plans →  ·  How the edges are graded →