Privacy Management delivers a complete data protection programme as running software. At its centre is a live inventory and data map that catalogues every field of personal information held across the operational, staging and logging tiers of the platform, classifying each by category, sensitivity and the legal basis under which it is processed. Around that inventory the module operates five interlocking capabilities: data minimisation, which sanitises audit, error and interface logs against per-entity field allowlists so that names, addresses and credentials never settle into secondary stores in clear text; consent and preference management, which records what each individual has agreed to and withdraws processing the moment agreement lapses; retention governance, which drives records through defined active, archive and deletion horizons automatically; subject rights handling, which fulfils access, rectification, erasure, restriction and portability requests end to end; and a secure vault that holds the most sensitive records under strong encryption. Together these turn privacy from a periodic assurance exercise into a controlled capability that is enforced at the point of processing and evidenced on demand.

The module is organised around a handful of durable concepts that map cleanly onto how privacy obligations actually work. The foundational one is the personal data field: a single located attribute of an individual, such as an email address, a telephone number or an authentication credential, tagged with its category, its sensitivity and the basis on which it is lawfully held. Fields aggregate into the data map, which is the organisation's complete picture of what personal information it processes and where.

Set against those fields is the data subject, the individual to whom the information relates, and the record of what that individual has permitted. A consent captures a specific, timestamped agreement to a defined purpose, together with its provenance and its lifespan, so that lawful basis can always be reconstructed for any moment in time. When an individual exercises their rights, the module raises a data subject request, a case that carries the demand from receipt through verification, fulfilment and closure within statutory deadlines. Governing all of this are retention policies, which express in business terms how long each category of information may persist before it is archived or destroyed, and the encryption keys that protect sensitive fields at rest. These concepts relate simply: fields are held about subjects, subjects grant consents and raise requests, and policies and keys enforce how long fields live and how strongly they are protected.

Three workflows carry most of the operational weight. The first is subject rights fulfilment. A request arrives through a self-service portal or an internal channel, the requester's identity is verified, and the module assembles every located field relating to that individual across the estate into a single response package. For erasure, it orchestrates a controlled sequence: soft deletion followed by hard deletion of the primary record, anonymisation of the individual's identifier wherever it appears in downstream logs, and revocation of the keys that protected their vaulted fields, so that the right to be forgotten is executed comprehensively rather than superficially.

The second is retention enforcement. Policies run continuously against live data, moving audit records from active storage into archive and then to deletion on their defined schedule, purging expired sessions and interface logs, and holding shorter horizons for the most PII-dense stores. The third is consent lifecycle management: capture, renewal, and withdrawal, with withdrawal propagating immediately into the modules that act on preferences so that marketing contact and other processing cease without manual intervention. Every step of every workflow is recorded, giving supervisory authorities and internal reviewers an unbroken evidentiary trail.

The module is built to the substance of the regulations it serves. It embodies the core GDPR articles directly: data minimisation is enforced through log sanitisation and field allowlists; privacy by design is expressed through classification at the point a field is defined; the right to erasure is delivered as a complete orchestration rather than a flag; and encryption of personal data is realised in the vault. Protection of sensitive records uses envelope encryption: field values are sealed with AES-256-GCM data encryption keys, and those keys are themselves encrypted by a master key encryption key held outside the data store, so that compromise of the database alone yields nothing readable. Keys are versioned and independently revocable, which is what makes cryptographic erasure of an individual's records possible.

Access is governed field by field. Sensitive attributes such as email and telephone are masked for roles that lack an explicit need, and personal data columns in operational tooling are gated behind that same authority model, so least privilege is applied to the attribute rather than the screen. Beyond GDPR, the module carries the obligations of CCPA around the right to know, delete and opt out of sale, the consent and unsubscribe duties of CAN-SPAM across subscription lists, and the cookie and electronic marketing consent requirements of PECR, giving multinational operations a single instrument for a fragmented regulatory map.

Privacy Management governs data the rest of the suite creates, so its integrations are intrinsic rather than optional. It draws directly on User Management for account attributes, session tokens and authentication secrets, treating credentials as first-class personal data under vault protection. It works with Marketing and Sales to hold the consent and subscription state behind every email opt-in and opt-out, so that outbound communication is always consistent with current permission. It constrains Data Management so that seeding, flushing and migration operations respect retention rules and never reintroduce data that should have expired. It relies on Flow Management to orchestrate multi-step erasure and rights fulfilment across systems. And it acts on the audit and error logging fabric of the platform, sanitising and masking log content so that secondary stores inherit the same protection as the systems of record. Through these connections privacy becomes a property of the whole suite, uniformly applied.

AI Workers are first-class participants in the module, not an overlay on it. A privacy officer can query the data map conversationally, asking where a category of information is held, which fields lack a recorded lawful basis, or what personal data relates to a named individual, and receive an assembled, sourced answer in moments. Workers execute actions directly: opening a subject request, driving an erasure orchestration, adjusting a retention horizon, or rotating a key, each within the same authority model and audit trail that governs human operators. They watch the estate continuously for anomalies and exceptions, flagging a request approaching its statutory deadline, a log field breaching its allowlist, a retention policy that has stalled, or personal data appearing where classification says it should not.

On intake, Workers extract and classify the personal data inside inbound documents and request payloads, verifying identity evidence and structuring free-form demands into actionable cases. They provide decision support to reviewers, summarising the basis, scope and risk of a request before it is actioned. And they serve as formal nodes in the module's workflows, standing as an approval or review step on erasure, key revocation and retention changes, so that sensitive privacy operations carry a recorded, accountable check whether the reviewer is a person or an AI Worker acting under delegated authority.