GDPR · Deployment evaluation

GDPR data flows and roles for a customer data platform (CDP)

This customer data platform (CDP) guide helps privacy and engineering teams map GDPR roles and data flows. Review purposes, processors, retention, rights and transfers across the whole workflow, including support access and destinations.

Scope your data and deployment requirements Review deployment options →

Technical planning guide · Review with your privacy and legal advisers

Legal and technical scope

Residency is one part of the assessment

GDPR requires a lawful basis and accountability. Controller and processor duties, security measures, data-subject rights and international-transfer rules still require assessment. Hosting in the EU does not by itself settle those questions.

Relevant provisions include Articles 5 and 6 (principles and lawfulness), 17–21 (rights), 28 (processors), 30 (processing records), 32 (security), 35 (impact assessments) and 44–49 (transfers). Applicability and exceptions depend on the processing. This page is a technical planning aid and does not certify a deployment or replace legal advice.

Planning your evaluation

Map the complete data flow before choosing a region

Apply these engineering review questions to the proposed PrivyCDP deployment. The expected output is a reviewed design and test record, not a blanket compliance claim.

Collection and purpose

List each source, identifier, event field and intended use. Reduce the payload to the fields the workflow needs. Record who approves a new source and how collection permissions reach downstream destinations.

Hosting, support and destinations

Draw the path through ingestion, profiles, logs, backups, AI services, support tools and activation providers. Mark locations and every party able to access the data, including remote administrators.

Retention and deletion

Specify retention by data category and test an approved deletion workflow using synthetic records. Check derived audiences, logs, replicas and destination systems; document exceptions and backup expiry rather than promising immediate removal everywhere.

Access and export

Test a least-privilege operator account, a restricted export and an access revocation. Document who can approve data exports, how their use is audited and which support access is time-limited.

Identity, consent and suppression

Test changed identifiers, duplicate profiles and an opt-out. Confirm that a newly joined identity does not silently restore a withdrawn permission. Reconcile suppression with each selected destination.

Approval and evidence

Have the privacy owner review the processing inventory and proposed agreements. Retain the approved data-flow map, security test results and operating responsibilities with the deployment release.

Discuss your deployment with engineers.

Bring your data flow, operating owners and evaluation questions.

Start deployment qualification Review Enterprise TCO Model →Request permissioned references and release-specific evidence during evaluation.

Frequently asked questions

Does GDPR require EU hosting?

GDPR does not impose a blanket EU-hosting rule. Assess territorial scope, processing and applicable international-transfer requirements with the privacy owner. Primary source

Does private deployment make a platform GDPR compliant?

Deployment location is one design decision. Lawful purposes, accountability, rights handling, security and processor relationships still need assessment. Primary source

Who is the controller or processor?

Roles depend on who determines purposes and means and who processes data on behalf of another party. Record the actual relationships and agreements. Primary source

How should we test a deletion request?

Use synthetic records and inspect profiles, derived audiences and destinations. Document retention exceptions and backup expiry rather than promising instant deletion everywhere. Primary source

Can support access affect the data-flow assessment?

Include administrators, support tools and subprocessors in the map. Review access locations and transfer arrangements for the actual processing. Primary source

Is this guide legal approval for a deployment?

No. It is an engineering checklist. The responsible privacy and legal reviewers must assess applicability and approve the operating process. Primary source