# Secure Privacy Knowledge Base - Full Content
> Complete article content for AI and LLM indexing. Published by Secure Privacy (https://secureprivacy.ai).
> This knowledge base covers GDPR compliance, cookie consent, data privacy governance, DPO services, and more.
---
# Google Tag Gateway (GTG) and Consent Management: How to Prevent Late Consent Signals and Keep Measurement Working
URL: https://support.secureprivacy.ai/article/google-tag-gateway-consent-management-late-consent-signal
Product: Consent Management
Category: Google Consent Mode
Published: 2026-06-04T12:33:00+00:00
Updated: 2026-06-04T12:40:02.126+00:00
Reading Time: 12 minutes
Summary: Google Tag Gateway can break consent mode timing on Cloudflare, Akamai & Fastly. Learn how to detect late consent signals and fix them with Secure Privacy.
Why your Google Ads conversions can disappear after enabling Google Tag Gateway
You enabled Google Tag Gateway (GTG) through your CDN — maybe a one-click Cloudflare, Akamai or Fastly integration — expecting better measurement and first-party tag serving. Instead, your Google Ads conversions drop, GA4 reporting goes quiet, and Tag Assistant starts flagging a late consent signal warning. Your cookie banner looks fine. Your tags look fine. So what's going on?
The common but painful "fixes" people try first all have downsides:
- Rolling back GTG entirely — you lose the conversion-measurement and first-party data benefits Google designed GTG to deliver.
- Switching to Basic Consent Mode — tags are blocked entirely until the user clicks Accept, so any late-loading consent stub means zero measurement for that page load.
- Hand-editing CDN routing rules — possible, but fragile, and most teams don't have the infrastructure access to do this safely.
There's a cleaner path. With Secure Privacy configured for Advanced Consent Mode (U+C), combined with Google's Data Transmission Controls and Global Consent Defaults, Google tags can load immediately under GTG and still respect consent — sending cookieless pings while consent is denied, and switching to full measurement the moment a user accepts. The load-order race condition stops mattering.
By the end of this article you'll know exactly what Google Tag Gateway does, how to check whether it's active on your site, how to diagnose a late consent signal, and which of three remediation paths fits your setup — with our recommended fix detailed step by step.
Who is this article for?
- Marketing, analytics or web teams who have enabled (or are considering enabling) Google Tag Gateway on Cloudflare, Akamai or Fastly
- Anyone seeing a "late consent signal" or "tag fired before consent default" warning in Google Tag Assistant
- Teams running Secure Privacy as their CMP alongside Google Ads, GA4 or Campaign Manager 360
- Implementers troubleshooting a sudden drop in conversions or modelled data after a CDN change
Prerequisites
- Access to your Google tag UI (Google Ads, GA4, or Google Tag Manager)
- Admin access to your Secure Privacy dashboard
- Google Tag Assistant installed for debugging
- Access (or a colleague with access) to your CDN configuration if you intend to use manual GTG setup
Overview
If your website uses Google Tag Gateway (GTG), the way your tags are served can affect when consent signals reach Google — and in some configurations, your measurement may stop working even when your banner is set up correctly.
This article explains what GTG is, how it can interact with your Secure Privacy banner, how to check whether GTG is active on your site, and what steps to take if you detect a timing issue.
What is Google Tag Gateway?
Google Tag Gateway (GTG) is a feature that lets you serve Google tags (gtm.js and similar scripts) from your own domain rather than from googletagmanager.com. It works through your existing Content Delivery Network (CDN), load balancer, or web server.
GTG is available for Google Tag Manager, Google Ads, and Google Analytics 4, and can be set up with major CDN providers including Cloudflare, Akamai, and Fastly.
Benefits Google cites for Google Tag Gateway
- Improved conversion measurement completeness
- Reduced reliance on third-party script domains
- First-party data collection from your own domain
See Google's overview: Google Tag Gateway for Advertisers.
How GTG can affect consent signal timing
One-click / automated CDN setup
When you set up GTG using the automated option (available for Cloudflare, Akamai, and Fastly), Google injects routing rules directly into your CDN configuration. This means gtm.js is served from your domain automatically, without you controlling when or in what order scripts load.
This creates a potential problem: your CMP consent stub may load after gtm.js has already initialised.
Why load order matters for Google Consent Mode
For consent mode to work correctly, your consent defaults must be established before any Google tags fire. Google's own documentation is explicit:
"The order of the code is vital. If your consent code is called out of order, consent defaults won't work."
"Don't set default consent states asynchronously."
When gtm.js loads before your Secure Privacy stub has called consent('default', ...), tags may execute before any consent state exists. This is called a late consent scenario.
What a late consent signal looks like in practice
In a correctly configured setup, the sequence is:
- CMP stub loads → calls consent('default', { ad_storage: 'denied', ... })
- gtm.js loads → tags respect the default denied state
- User interacts with banner → consent('update', ...) fires → tags fire or remain blocked based on choices
In a late consent scenario with GTG CDN injection:
- gtm.js loads (via CDN injection)
- Tags fire — no consent state exists yet
- CMP stub loads → calls consent('default', ...) — too late
Google's Tag Assistant will flag this as an error in the consent timeline.
For more on consent mode fundamentals: Consent Mode overview · Set up consent mode on websites.
How to check whether Google Tag Gateway is active on your site
You can verify GTG enrollment status from within your Google tag interface (Google Ads, GA4, or Google Tag Manager).
GTG status indicators to look for
Status
Meaning
First-party
GTG is active and serving tags from your domain
Active
Setup complete; your domains are listed
Pending
GTG is enabled but no diagnostic data has been received yet
Paused
GTG has been paused
Not started
GTG has not been activated
How to verify using Google Tag Assistant
- Open Tag Assistant and enter your website URL
- Start a session and allow the page to load
- In the Summary panel, go to Output → Hits Sent
- Check that hits are routed to your own measurement path (your domain), not to googletagmanager.com
If hits show your domain as the source, GTG is active.
Setup guides by CDN provider: Cloudflare · GTG setup guide (general) · GTG with CDN + server-side tagging.
What to do if you detect a late consent signal and GTG is active
If your Secure Privacy banner is detecting a late consent signal (consent update fires after Google tags have already executed), and you have confirmed that GTG is active, you have three remediation paths. We recommend Option A.
Option A — Adopt Advanced Consent Mode (U+C) with Data Transmission Controls and Global Consent Defaults (recommended)
Why this works: Advanced Consent Mode loads Google tags immediately but sends cookieless measurement pings when consent is denied. This means even if there is a load-order issue with GTG, measurement continuity is preserved — tags are never fully blocked, they simply operate in a privacy-safe mode until consent is granted.
Step 1 — Enable Advanced Consent Mode (U+C) in Secure Privacy
In your Secure Privacy dashboard, switch the banner to Advanced Consent Mode (U+C). This configures your banner to call consent('default', ...) with denied states and consent('update', ...) when the user makes a choice.
Step 2 — Enable Data Transmission Controls in your Google tag
Data Transmission Controls are available in Google Ads, GA4, and Campaign Manager 360. They let you independently configure what data Google tags can send while consent is denied:
- Advertising data — limit or block ad data until consent is granted
- Behavioural analytics — block analytics data collection until consent is granted
- Diagnostics — block diagnostic pings until consent is granted
Step 3 — Enable Global Consent Defaults in GTM
In your Google tag configuration in GTM, enable Global Consent Defaults. This setting overrides any consent('default') commands in your website code and sets a baseline denied state per region — useful when you cannot guarantee the CMP stub will always load first.
Reference: Data Transmission Controls · About Consent Mode (GTM).
Option B — Migrate all tags into a GTM container and deploy GTM via GTG
Why this works: If all your tags live inside a single GTM container, GTM's built-in consent mode support ensures tags respect the consent state set by your CMP. GTG then serves the GTM container itself from your domain, rather than injecting individual tag scripts separately.
Step 1 — Consolidate all Google tags into a single GTM container
Move Google Ads, GA4, Floodlight, and any other Google tags currently loaded directly on the page into one Google Tag Manager container.
Step 2 — Configure GTG to serve the GTM container from your domain
Set up GTG so that the GTM container (gtm.js) is served from your first-party domain.
Step 3 — Place the Secure Privacy stub before the GTM snippet
Ensure your Secure Privacy banner is initialised before the GTM snippet in your page so that consent defaults are set first.
Option C — Set up GTG manually to regain control over script load order
Why this works: Instead of using the one-click automated CDN injection (which removes your control over load order), you configure your CDN or load balancer routing rules manually. This lets you ensure your CMP stub always loads and fires consent('default', ...) before gtm.js is requested.
Step 1 — Do not use the automated one-click GTG setup
Avoid the one-click GTG setup option in the Google tag UI, since it removes your control over load order.
Step 2 — Configure your CDN routing rules manually
Configure your CDN (Cloudflare, Akamai, Fastly, etc.) routing rules manually, following Google's self-service setup instructions.
Step 3 — Place the Secure Privacy stub before the Google tag snippet
Ensure your page order places the Secure Privacy stub snippet above the Google tag snippet.
Reference: GTG setup guide · GTG with CDN.
Why Advanced Consent Mode is the recommended path for GTG-enabled tags
Advanced Consent Mode (also called U+C — "Update and Collect") is the only remediation path that works regardless of your GTG configuration:
- It is fully compatible with one-click automated CDN injection (Option A)
- It is fully compatible with manual GTG setup (Option C)
- It preserves conversion modeling even when consent is denied, by sending cookieless pings to Google
- Basic Consent Mode, by contrast, blocks tags entirely until consent is granted — if the consent stub loads late, there is no measurement at all for that page load
If you are using GTG and are unsure which path to take, start with Option A. Options B and C require more infrastructure changes and may not be feasible depending on your setup.
Debugging late consent issues with Google Tag Assistant
If you suspect a late consent problem, use Google's Tag Assistant to diagnose it:
- Open Tag Assistant and connect to your site
- Open the Consent tab in the Summary panel
- Look at the consent timeline — Tag Assistant will flag cases where tags fired before consent('default', ...) was called
- Check the order of events: the default consent call must appear before any tag firing events
Full debugging guide: Troubleshoot consent mode with Tag Assistant.
Common late consent failure modes
- "Tag fired before consent default was set" — almost always a load-order issue caused by one-click GTG CDN injection. Fix with Option A.
- Tags blocked entirely / no pings at all on denied page loads — you're on Basic Consent Mode with a late-loading stub. Move to Advanced (U+C) so cookieless pings continue while consent is denied.
- Consent state shows as unknown in Tag Assistant — the default consent command never fired on this page. Confirm your Secure Privacy stub is present and that wait_for_update is set (500ms is the Google-recommended value).
Summary table — which fix to choose
Situation
Recommended action
GTG is active (one-click CDN) and you see late consent
Follow Option A — enable Advanced Consent Mode + DTCs + Global Consent Defaults
GTG is active and you want maximum control over load order
Follow Option C — switch to manual GTG setup
You want to simplify tag management and have all tags in GTM
Follow Option B — migrate to GTM container deployed via GTG
You're unsure if GTG is active
Check status in Google tag UI or verify via Tag Assistant
Frequently asked questions
What is Google Tag Gateway (GTG)?
Google Tag Gateway is a Google feature that lets you serve Google tags such as gtm.js from your own first-party domain instead of from googletagmanager.com. It works through your CDN, load balancer or web server, and is available for Google Tag Manager, Google Ads, and Google Analytics 4 — with one-click setup for Cloudflare, Akamai, and Fastly.
Why are my Google Ads conversions dropping after enabling Google Tag Gateway?
The most common cause is a late consent signal. When GTG is set up via one-click CDN injection, gtm.js may load before your CMP stub has set consent defaults. Tags fire without a consent state, Tag Assistant flags it as an error, and conversion data is lost or unmodeled. The recommended fix is to enable Advanced Consent Mode (U+C) in Secure Privacy together with Data Transmission Controls in your Google tag.
How do I check if Google Tag Gateway is active on my site?
Open your Google tag UI (Google Ads, GA4, or GTM) and look at the GTG enrollment status — "First-party" or "Active" means GTG is serving tags from your domain. You can also confirm via Google Tag Assistant: in the Summary panel, check Output → Hits Sent. If hits route to your domain rather than googletagmanager.com, GTG is active.
What is a late consent signal?
A late consent signal is when Google tags fire before your CMP has called consent('default', ...) to set a baseline consent state. Google's documentation is explicit that this breaks consent mode behaviour: tags may collect data without respecting the user's eventual choice, and Tag Assistant will flag the event in the consent timeline.
Does Google Tag Gateway work with Cloudflare, Akamai, and Fastly?
Yes. All three providers support GTG, and Google offers a one-click automated setup for each. The trade-off with one-click setup is that Google injects routing rules directly into your CDN configuration, which can introduce a load-order issue between gtm.js and your CMP stub. Manual setup is also available if you need full control over load order.
What is the difference between Basic and Advanced Consent Mode for GTG?
Basic Consent Mode blocks Google tags entirely until consent is granted — so if the consent stub loads late under GTG, there is no measurement at all for that page load. Advanced Consent Mode (U+C) lets tags load immediately and send cookieless pings while consent is denied, preserving conversion modelling. Advanced Consent Mode is the recommended path for any site using Google Tag Gateway.
Do I need to roll back Google Tag Gateway to fix a late consent signal?
No. Rolling back GTG forfeits the first-party measurement benefits it provides. The recommended fix is to switch Secure Privacy to Advanced Consent Mode and enable Google's Data Transmission Controls and Global Consent Defaults, so measurement continues safely under denied consent without depending on script load order.
What are Data Transmission Controls and where do I enable them?
Data Transmission Controls are settings in Google Ads, GA4, and Campaign Manager 360 that independently restrict what data Google tags can transmit while consent is denied — covering advertising data, behavioural analytics, and diagnostics. You enable them inside your Google tag configuration in the respective product UI.
Related articles
- Google Consent Mode: Basic vs Advanced — Complete Guide
- How to Implement Google Consent Mode Advanced with GTM
- How to Check If Google Consent Mode Is Working
- How to Set Up Secure Privacy CMP via Google Tag Consent Mode
- How to Comply with Google's EU User Consent Policy
For further guidance, contact Secure Privacy support or refer to Google's consent mode implementation guide.
---
# How to Install Secure Privacy CMP via Google Tag Consent Mode (Google Ads & GTM)
URL: https://support.secureprivacy.ai/article/how-to-install-secure-privacy-cmp-via-google-tag-consent-mode-google-ads-gtm
Product: Consent Management
Category: Google Consent Mode
Published: 2026-06-01T07:29:00+00:00
Updated: 2026-06-04T13:36:11.834+00:00
Reading Time: 9 minutes
Summary: Set up Google Consent Mode v2 with Secure Privacy in minutes — directly inside Google Ads or GTM. Step-by-step guide. No manual gtag configuration needed.
If your website serves visitors in the European Economic Area (EEA) or the UK, and you're running Google Ads or using
Google Analytics, you're almost certainly losing conversion data — and you may not have noticed yet. Since
March 2024, Google has required all advertisers to implement Google Consent Mode
v2 via a certified Consent Management Platform (CMP) for EEA and UK traffic. By July
2025, Google began actively restricting conversion tracking and audience creation for accounts that
weren't compliant. For some advertisers that meant an overnight drop of 80–90% in measured conversions.
The two painful workarounds most teams try first don't hold up. Writing manual
gtag('consent', 'default', ...) code is error-prone, hard to maintain, and still requires a separate
consent banner that actually meets GDPR standards. Bolting on a generic cookie notice without a proper Google
integration means consent signals never reach your Google tag — so modeling never kicks in and attribution stays
broken.
There's a cleaner path. In 2025, Secure Privacy built a deep integration directly inside the Google Tag
platform, which Google approved and made live in April 2026. Secure Privacy is now listed as a
fully integrated platform inside Google's own consent mode wizard — meaning you can connect a
compliant, Google Gold CMP Partner to your Google tag in minutes, with no manual gtag configuration on your end.
By the end of this guide you will have Google Consent Mode v2 active on your site, your consent signals flowing
correctly to Google Ads and Google Analytics, and a built-in test to confirm everything is working.
Who Is This Guide For?
This guide is for you if any of the following apply:
-
You run Google Ads campaigns targeting EEA or UK audiences and you don't yet have a consent banner connected
to your Google tag.
-
You're a marketer or developer setting up Google Consent Mode v2 for the first time and want to avoid manual
gtag code.
-
You've seen a warning in Google Ads about consent mode not being configured, or you've noticed a spike in
"(not set)" traffic source data in GA4.
-
You're evaluating a Google-certified CMP and want to understand what the setup process looks like in
practice.
Prerequisites
-
Access to a Google Ads or Google Tag Manager account — specifically, access to a Google Tag.
This can be a tag connected to Google Ads, Google Analytics 4, or any other Google product.
-
Your website domain (you will associate it with your Secure Privacy account during setup).
-
A Secure Privacy account — a free tier is available and can be created directly inside the wizard without
leaving Google.
Step-by-Step Setup Guide
Step 1 — Open the Google Tag Admin Settings
In Google Ads: navigate to Tools in the left sidebar, then open Data
manager. Click into your Google tag to open its settings panel, and select the Admin
tab along the top.
Google Ads → Tools → Data manager → select your Google tag → Admin tab.
In Google Tag Manager: navigate to Google tags and select your tag from the list.
Click into your Google tag to open its settings panel, then select the Admin tab along the top.
Google Tag Manager → Google tags → select your tag → Admin tab.
Step 2 — Click "Set Up Consent Mode"
On the Admin tab you will see a Google tag management section listing several configuration options.
Click Set up consent mode. This launches a guided setup wizard.
Under Google tag management, click "Set up consent mode" to launch the wizard.
Note: If you see a Google tag gateway: Incomplete status on the Admin page, this is
a separate first-party tagging concern and does not block consent mode setup. You can proceed with the
wizard regardless.
Step 3 — Select Your Consent Banner Type
The first screen of the wizard asks: "Which type of consent banner do you have?"
Select "I don't have a consent banner", then click Next. This is the correct option
even if you have a basic cookie notice — if it's not yet connected to a certified CMP, you effectively don't have a
compliant banner for Google's purposes.
Select "I don't have a consent banner" and click Next.
Step 4 — Select Your Platform
The next screen is titled "Set a third-party banner" and explains how CMPs work with Google Consent
Mode. Click the "Select your platform" button to open the platform picker.
Click "Select your platform" to open the CMP platform picker.
Step 5 — Choose Secure Privacy
A side panel will appear titled "Select a third-party platform (to create your banner)". Under the
Fully integrated platforms section, find and select Secure Privacy — it is listed
with "Free tier available".
Under Fully integrated platforms, select Secure Privacy.
Follow the remaining on-screen prompts. If you don't yet have a Secure Privacy account, you can create one here — no
need to leave the Google interface.
Why "fully integrated" matters: Secure Privacy's fully integrated status means Google has a direct,
verified integration path. No manual gtag('consent', 'default', ...) configuration is required on your
end — Secure Privacy handles consent signal communication to your Google tag automatically.
Step 6 — Confirm Setup
After completing the prompts, you'll see a setup confirmation screen showing your Secure Privacy CMP
account connected to the Google tag, along with options to publish your consent banner via Google Tag
Manager or manually.
Setup confirmation — your consent signals are now active.
To publish your banner, select a GTM container from the list and apply the changes to a workspace, or use the Install
manually option if you manage your tag code directly.
What Happens After Setup
Test your consent signals
After completing setup, return to the first screen of the consent mode wizard and expand the "Test your
consent signals" section. This built-in tool confirms whether consent state is being communicated
correctly from Secure Privacy to your Google tag. Look for a green "Your consent signals are active"
confirmation.
When will Google Ads show consent mode as active?
The consent mode status in your Google Ads account typically updates within 48 hours, but may take
up to two weeks to fully reflect in your account's consent settings panel.
When will conversion modeling start?
Google Ads conversion modeling for consent-denied users requires at least 700 ad clicks over a 7-day
period per country and domain grouping. Modeled conversions begin appearing in your Conversions columns
after the threshold is reached. Google Analytics 4 behavioral modeling requires at least 1,000 denied-consent events
per day for at least 7 days.
What about users who already had consent granted?
For users who interacted with your site before consent mode was in place, there is no retroactive data recovery.
Going forward, Advanced consent mode (which Secure Privacy implements) enables advertiser-specific modeling to
estimate conversions from non-consenting users based on aggregate signals.
Troubleshooting
Secure Privacy doesn't appear in the platform picker
Make sure you are on the Fully integrated platforms section of the picker, not the "Set instructions
only" section lower down the list. If the panel doesn't load, try refreshing the page and re-entering the wizard
from the Admin tab.
Consent signals test shows "Not active" after setup
This usually means the banner has not yet been published. Complete the banner publication step — either by selecting
a GTM container and publishing the workspace, or by installing the banner code manually on your site. Once the
banner is live, re-run the consent signals test.
Google tag gateway shows "Incomplete"
This is a separate first-party tagging configuration and does not affect consent mode. It refers to whether your
Google tag is operating in a first-party context. You can address it independently through the Google tag gateway
settings without any impact on your consent mode integration.
GA4 shows a spike in "(not set)" for traffic source
This is a known issue that occurs when session_start and page_view events fire before
consent is established. Make sure your Secure Privacy banner is loading before any Google tags fire on your
pages. If you're using GTM, ensure the consent initialization tag fires on the earliest possible trigger (Consent
Initialization trigger type).
GOOGLE GOLD CMP PARTNER · SOC 2 TYPE II · IAB TCF v2.3
Get compliant with Google Consent Mode v2 — without the complexity
Secure Privacy is a fully integrated Google Tag platform partner. Set up your consent banner directly inside Google
Ads or GTM and restore conversion tracking for EEA audiences.
Get Started
for Free Schedule a Demo
30-day free trial · No credit card required
Frequently Asked Questions
Do I need a consent banner to run Google Ads in the EEA?
Yes. Since March 2024, Google requires all advertisers with EEA or UK traffic to implement Google Consent Mode v2 via
a certified CMP. Without it, Google will not populate remarketing audiences and conversion tracking is restricted
for those users. Enforcement with active account restrictions began in July 2025.
What is Google Tag Consent Mode and why do I need it?
Google Tag Consent Mode is a framework that tells Google's tags (Google Ads, GA4, Floodlight) how to behave based on
a visitor's cookie consent choices. It enables conversion modelling so Google can estimate conversions from users
who did not consent, recovering a portion of the attribution data that would otherwise be lost entirely.
Is Secure Privacy a Google-certified CMP?
Yes. Secure Privacy is a Google Gold CMP Partner and appears in Google's own platform picker as a
fully integrated platform. This is the highest tier of Google CMP certification and means the integration is
verified and maintained directly with Google.
Do I need to write any gtag code to set this up?
No. Because Secure Privacy is listed as a fully integrated platform inside the Google Tag consent mode wizard, the
integration is handled automatically. Secure Privacy manages consent signals to your Google tag without any manual
gtag code.
Can I do this setup inside Google Tag Manager instead of Google Ads?
Yes. The same wizard is available inside Google Tag Manager. Navigate to your Google tags list, click into your tag,
open the Admin tab, and follow the same steps described in this guide.
What happens if the Google tag gateway shows as Incomplete?
This is a separate first-party tagging concern and does not block consent mode setup. You can complete the consent
mode integration regardless, and address the gateway configuration separately at a later stage.
How do I verify that consent signals are working after setup?
Use the "Test your consent signals" section available on the first screen of the consent mode
wizard. It will confirm whether consent state is being communicated correctly to the Google tag. You can also use
Google Tag Assistant to inspect consent state values (gcs parameter) in real time.
Related Articles
-
How
to Implement Google Consent Mode Advanced with GTM
-
Google Consent Mode Basic
vs Advanced — Complete Guide
-
How to Check If Google Consent Mode Is
Working
-
How to Implement Google Consent
Mode Basic
-
How to Comply
with Google's EU User Consent Policy
-
Secure Privacy:
Google-Certified Consent Management Platform
---
# What Is Amazon Consent Mode (Amazon Consent Signal)? A Complete Guide for Advertisers
URL: https://support.secureprivacy.ai/article/what-is-amazon-consent-mode-amazon-consent-signal-a-complete-guide-for-advertise
Product: Consent Management
Category: Policies & User Consent
Published: 2026-05-19T19:25:00+00:00
Updated: 2026-05-20T19:49:22.431+00:00
Reading Time: 10 minutes
Summary: Amazon Consent Signal (ACS) is mandatory for EEA/UK Amazon Ads since Feb 2025. Learn how amzn_user_data & amzn_ad_storage work and how to stay GDPR compliant.
If you run Amazon Ads with EEA or UK traffic, you are required to send a valid consent signal to Amazon before transmitting any personal data. Here is what that means, where it comes from officially, and what you need in place.
You have a cookie consent banner on your site. Your visitors see it, some accept, some decline. But does Amazon Ads actually know about those choices? Unless you have specifically configured a consent signal for Amazon, almost certainly not — and that is a compliance and campaign performance problem.
Amazon Ads operates its own consent framework, officially called the Amazon Consent Signal (ACS). You will also see it referred to informally as "Amazon Consent Mode", by analogy with Google's equivalent. The requirement exists because Amazon's advertising services process personal data on behalf of advertisers — and under GDPR and the ePrivacy Directive, that processing requires valid, documented user consent for EEA and UK users.
This article explains what Amazon's official policy requires, how ACS works based on available documentation, how it differs from Google Consent Mode, and what you need to put in place. Where specific technical details could not be confirmed directly from Amazon's own public documentation, this is explicitly flagged.
Who Needs to Read This?
- Advertisers using Amazon Ads (Sponsored Products, Sponsored Brands, Amazon DSP, Display Ads, Amazon Attribution) with EEA or UK traffic
- Publishers and third-party data providers transmitting audience data to Amazon Ads on behalf of advertisers
- Privacy and compliance teams verifying GDPR coverage across all ad platforms, not just Google
- Marketing teams troubleshooting Amazon campaign performance issues tied to consent gaps
Not in scope: If you run Amazon Ads targeting only US audiences with no EEA or UK traffic, Amazon's consent signal requirement does not currently apply to those campaigns.
What Amazon's Official Policy Requires
Amazon's own policy page — Sending Personal Information to Amazon Ads & Amazon Consent Signal requirements — states the following directly:
"If you transmit or make available to Amazon Ads any personal information in connection with your use of any Amazon advertising services, you must either use (i) the IAB European Transparency & Consent Framework (TCF) signal(s), or (ii) Amazon Consent Signal, to communicate your UK and EEA users' privacy choices to Amazon Ads."
That same policy page specifies that advertisers must:
- Publish a clear and transparent privacy policy that meets applicable legal requirements including GDPR
- Collect individuals' affirmative opt-in consent for Amazon to process their personal information and use cookies or similar technology for advertising
- Allow individuals to withdraw consent at any time
- Keep records of consent and opt-out choices and provide Amazon with access to those records upon request
- Not pass personally identifiable information (names, email addresses, phone numbers) to Amazon
- Not pass personal information collected from children under 13
- Not pass sensitive personal information (financial status, health or medical information)
Amazon's EU data protection page confirms that Amazon Ads is a registered vendor on the IAB Europe Transparency & Consent Framework (TCF), and that third-party publishers adhering to TCF v2.0 allow users to consent to or object to receiving interest-based ads from Amazon.
In plain terms: you have two compliant options — implement IAB TCF via a compatible CMP, or implement Amazon's own Amazon Consent Signal. A CMP that supports neither means you are transmitting EEA/UK user data to Amazon without a valid consent mechanism.
What Is Amazon Consent Signal?
Amazon Consent Signal (ACS) is Amazon Ads' own consent communication framework — the alternative to IAB TCF for advertisers who want to use Amazon's proprietary format. It lets advertisers tell Amazon whether a given user has consented to having their personal data processed for advertising and whether advertising cookies may be read or written to their device.
Based on implementation documentation published by Amazon's certified CMP partners (including Usercentrics and Cookiebot, both of whom have integrated directly with Amazon), ACS communicates consent via a first-party cookie named amzn_consent, containing a structured JSON object that Amazon's tags read at request time.
Source note: The specific technical details below — parameter names, cookie format, and JSON structure — are sourced from CMP partner implementation documentation, not directly from an Amazon-published technical specification. Amazon's Advanced Tools Center documentation requires authentication and was not publicly accessible at the time of writing. These details are consistent across multiple independent CMP implementations and are included here as the best available technical reference, not as verified Amazon primary source material.
The Two Consent Parameters
ACS is built around two parameters:
Amazon Consent Signal parameters — as documented by Amazon CMP implementation partners
Parameter
What it controls
Accepted values
amzn_user_data
Whether the user has consented to Amazon processing their personal data (such as advertising identifiers) for advertising purposes
GRANTED or DENIED
amzn_ad_storage
Whether the user has consented to Amazon reading or writing advertising cookies or similar tracking technologies on their device
GRANTED or DENIED (may also be NULL when ad storage is not relevant)
Both parameters map to the Marketing consent category in a CMP. When a visitor grants Marketing consent, both are set to GRANTED. When they decline, both are set to DENIED.
The Country Code Requirement
ACS also requires an ISO 3166-2 country code alongside the consent parameters — for example DE for Germany, FR for France, GB for the United Kingdom. Your CMP must detect the visitor's country and include the correct code so Amazon can apply the appropriate regional compliance rules.
The amzn_consent Cookie
The signal is stored and transmitted as a first-party cookie. A typical cookie value looks like this:
amzn_consent={
"geo": { "countryCode": "DE" },
"amazonConsentFormat": {
"amznAdStorage": "GRANTED",
"amznUserData": "GRANTED"
},
"timestamp": "2025-06-15T09:42:11.000Z",
"version": "1"
}WAF note: Because the amzn_consent cookie value contains JSON, some Web Application Firewalls may flag or block it. If the cookie is not being set after CMP configuration, check your WAF rules and add an explicit exception for the amzn_consent cookie name.
Amazon Consent Signal vs. Google Consent Mode: Key Differences
Having Google Consent Mode v2 implemented does not satisfy your Amazon obligation. The two frameworks are entirely separate and must each be configured independently.
Amazon Consent Signal vs. Google Consent Mode v2 — comparison
Amazon Consent Signal (ACS)
Google Consent Mode v2 (GCM v2)
Official name
Amazon Consent Signal
Google Consent Mode v2
How consent is transmitted
First-party cookie (amzn_consent)
JavaScript API calls via dataLayer (gtag('consent', ...))
Consent parameters
amzn_user_data, amzn_ad_storage
ad_storage, analytics_storage, ad_user_data, ad_personalization
Parameter values
GRANTED / DENIED (uppercase)
'granted' / 'denied' (lowercase strings)
Country code
Required — ISO 3166-2
Optional — via region parameter
IAB TCF alternative accepted
Yes — TCF is explicitly accepted in Amazon's policy
Works alongside TCF but requires its own separate configuration
Do they conflict?
No — both frameworks are independent and run simultaneously without conflict.
What Happens Without a Valid Consent Signal?
Amazon's own policy is explicit: if you transmit personal data from EEA or UK users to Amazon Ads without a valid TCF or ACS signal, you are in breach of Amazon's advertising policies. The policy states that if you discover personal data was shared in violation of these requirements, you must "cease processing and sharing that data immediately" and notify Amazon in writing.
Beyond policy consequences, the practical advertising impact is that Amazon cannot confirm valid consent exists for those users, which may restrict how their data is used for targeting, measurement, and attribution — reducing campaign reach and degrading conversion reporting for affected users.
There is also the underlying GDPR exposure: transmitting personal data of EEA/UK users to any ad platform without a documented consent basis is a potential regulatory violation independent of what Amazon enforces technically.
How Amazon Consent Signal Works With a CMP
The correct flow for ACS with a consent management platform is:
- A visitor arrives on your page and is shown the consent banner by your CMP.
- The visitor makes a consent choice — accepting, rejecting, or customising their marketing preferences.
- The CMP writes the amzn_consent cookie with the correct parameter values, the visitor's country code, and a timestamp.
- Amazon's advertising tags read the cookie on the next ad request and apply the appropriate data handling rules.
- The CMP logs consent evidence for audit purposes.
If the user returns later, the cookie persists within its expiry period. If they change their consent preferences, the CMP updates the cookie immediately to reflect the new state.
Secure Privacy and Amazon Consent Signal
Secure Privacy's Amazon Consent Signal integration is currently in development. When available, it will allow the same consent banner that drives your Google Consent Mode v2 signals to simultaneously write the correct amzn_consent cookie — with the right country code and consent values — removing the need to maintain separate integrations for each ad platform.
If you are a current Secure Privacy customer running Amazon Ads with EEA or UK traffic, contact our team to discuss your current compliance position and to be notified when ACS support is available.
Troubleshooting Amazon Consent Signal
The amzn_consent cookie is not being set
Most likely cause: a Web Application Firewall is blocking the cookie because its JSON value triggers a security rule. Add an explicit WAF exception for the amzn_consent cookie name. Also confirm that Amazon Advertising is added as a Marketing-category service inside your CMP settings and that the ACS integration is enabled.
The cookie shows DENIED even after the user accepts
Most likely cause: Amazon Advertising is not mapped to the Marketing consent category in your CMP, or the CMP is not triggering a cookie update after consent is granted. Verify the service mapping and confirm the consent-update event fires correctly on banner acceptance.
The country code is wrong or missing
Country code is a required field — an absent or incorrect value renders the signal invalid. Check that your CMP's geolocation feature is enabled and correctly detecting visitor countries for EEA and UK traffic.
Frequently Asked Questions
What is Amazon Consent Mode?
"Amazon Consent Mode" is the informal name for the Amazon Consent Signal (ACS) — Amazon Ads' framework for receiving user consent preferences from advertisers' websites. Amazon's official policy requires that any advertiser transmitting personal data from EEA or UK users to Amazon Ads must use either IAB TCF or ACS to communicate those users' privacy choices. ACS uses two parameters (amzn_user_data and amzn_ad_storage) transmitted via a first-party cookie called amzn_consent.
Is Amazon Consent Signal the same as Google Consent Mode?
No. They are entirely separate frameworks built for different ad ecosystems. Google Consent Mode v2 operates via JavaScript API calls and covers Google Ads, GA4, and related products. Amazon Consent Signal operates via a first-party cookie and covers Amazon Ads. Each must be implemented independently. Having GCM v2 in place does not satisfy your ACS obligation, and both can run simultaneously without conflict.
What are the two Amazon Consent Signal parameters?
The two ACS parameters are amzn_user_data (whether the user has consented to Amazon processing their personal data for advertising) and amzn_ad_storage (whether the user has consented to Amazon reading or writing advertising cookies on their device). Both accept GRANTED or DENIED and are transmitted inside the first-party amzn_consent cookie alongside an ISO 3166-2 country code.
Do I need Amazon Consent Signal if I already use IAB TCF?
No — Amazon's official policy explicitly accepts either IAB TCF or ACS. If your CMP generates a valid TCF consent string and passes it correctly to Amazon Ads, you satisfy the requirement through TCF. ACS is Amazon's alternative for advertisers not using a TCF-compliant CMP.
What does Amazon's policy actually say about EEA consent?
Amazon's official policy at advertising.amazon.com/resources/ad-policy/consent-signal-requirements states that any advertiser transmitting personal data to Amazon Ads in connection with advertising services must use either IAB TCF or Amazon Consent Signal to communicate UK and EEA users' privacy choices. It also requires advertisers to collect affirmative opt-in consent, maintain consent records, and allow users to withdraw consent at any time.
Can I implement Amazon Consent Signal without a CMP?
Technically yes — ACS can be implemented by manually writing the amzn_consent cookie with the correct JSON structure. However, this requires correctly detecting visitor country codes in real time, updating the cookie whenever consent changes, and maintaining consent records for audit purposes. A CMP with built-in ACS support handles all of this automatically and significantly reduces the risk of implementation errors.
Does Secure Privacy support Amazon Consent Signal?
Secure Privacy's Amazon Consent Signal integration is currently in development. Once available, it will allow the same consent banner driving your Google Consent Mode v2 signals to simultaneously write the correct amzn_consent cookie, covering both Google and Amazon from a single CMP configuration. Contact Secure Privacy to be notified when ACS support is released.
Related Articles
- Google Consent Mode v2 Parameters Explained: URL Passthrough, Data Redaction & Every Setting You Need to Know
- Google Consent Mode: Basic vs. Advanced — Complete Guide
- How to Implement Google Consent Mode Advanced with GTM
- How to Comply with Google's EU User Consent Policy
- Secure Privacy: Google-Certified Consent Management Platform
---
# Managing Data Subject Access Requests v2 (DSARs) in Secure Privacy
URL: https://support.secureprivacy.ai/article/managing-data-subject-access-requests-dsars-in-secure-privacy
Product: Consent Management
Category: DSARs
Published: 2026-05-15T21:56:00+00:00
Updated: 2026-05-18T10:30:48.571+00:00
Reading Time: 12 minutes
Summary: Create and manage GDPR-compliant DSAR forms in Secure Privacy. Configure request types, embed your widget, route to Governance, and handle privacy rights requests at scale.
Every website that collects personal data is legally required to give visitors a way to exercise their privacy rights — the right to access, delete, correct, or export the data you hold about them. Under GDPR, CCPA, LGPD, and 65+ other privacy laws, failing to provide a working, documented intake process for these requests isn't just a compliance gap: it's an enforcement risk. Yet most organisations still handle data subject access requests (DSARs) through ad-hoc email inboxes, spreadsheets, or generic contact forms — approaches that leave you exposed when regulators or auditors ask for evidence of timely, structured responses.
Dedicated DSAR management software closes this gap. The Secure Privacy CMP includes a built-in DSAR module that lets you create branded, multi-language privacy request forms, embed them on any website or app, route submissions to the right team members or to the Secure Privacy Governance Portal for centralised compliance tracking, and manage everything — including bulk operations across multiple properties — from a single dashboard.
This guide covers everything you need to configure, embed, and manage DSARs in Secure Privacy, including the latest DSAR 2.0 features that make the module faster to set up and easier to scale across multi-domain organisations.
By the end of this article you will be able to: create a DSAR form, customise its fields and request types, embed it on your website, route submissions to your team or Governance Portal, and handle incoming requests in a fully auditable, regulation-ready workflow.
Who Is This Guide For?
This article is written for Account Administrators on the Secure Privacy CMP. It is relevant to anyone responsible for privacy compliance, including Data Protection Officers (DPOs), legal teams, marketing operations managers, and web developers implementing privacy request forms on behalf of their organisation.
Overview: The Secure Privacy DSAR Module
The DSAR section of the Secure Privacy CMP is your central workspace for creating and managing Data Subject Access Request forms — the privacy rights intake mechanism through which website visitors can submit requests to access, delete, export, or correct their personal data. With DSAR 2.0, the module is now a dedicated, top-level feature in Secure Privacy Web, fully decoupled from the Template system, so DSAR management is easier to find, easier to configure, and easier to scale across multiple properties.
Each DSAR is a standalone, configurable form that can be:
- Linked to one or more of your registered domains, mobile apps, or TV apps
- Presented in multiple languages (70+ supported)
- Customised with your organisation's branding and field labels
- Routed to the Secure Privacy Governance Portal for centralised compliance tracking, or delivered by email to a designated team member or external DPO
- Embedded on any webpage via a lightweight JavaScript widget
Prerequisites
- An active Secure Privacy account with Account Administrator permissions
- At least one domain or mobile app registered in your Secure Privacy workspace
- Access to the page source of your website (to paste the embed script), or a developer who can add a
When a user grants or denies consent via your CMP banner, the Secure Privacy as certified Google CMP calls:
gtag('consent', 'update', {
'ad_storage': 'granted', // or 'denied'
'ad_user_data': 'granted', // or 'denied'
'ad_personalization': 'granted', // or 'denied'
'analytics_storage': 'granted' // or 'denied'
});The update command above, again, is fired automatically when the user interacts with the consent banner. No manual configuration is required.
For GTM-based implementations, see How to Implement GCM Advanced with GTM.
Official reference: Set up consent mode on websites — Google Tag Platform documentation
Impact on Google Ads Conversion Tracking and Google Analytics 4
Google Ads: Conversion Modeling Thresholds
When consent is denied and you are using Advanced Consent mode, Google fills the measurement gap with conversion modeling. Key facts:
- Modeling eligibility requires at least 700 ad clicks over a 7-day period per country and domain grouping
- At least 7 full days of GCM v2 implementation are required before modeling begins
- Modeled conversions appear in the standard "Conversions" and "Conversion value" columns with the same column granularity as observed conversions
- Consented users are typically 2–5× more likely to convert than unconsented users—meaning the modeled uplift is significant
- Consent mode status in Google Ads takes 48 hours to appear, but may require up to 2 weeks; modeling uplift numbers appear for 4 weeks after modeling start date
Remarketing enforcement (active since July 21, 2025): Without GCM v2, Google will not populate remarketing audiences for EEA users at all. Cookieless pings are never used to build remarketing lists—audience creation requires ad_personalization='granted'.
Google Ads modeling reference: About consent mode conversion modeling — Google Ads Help
Google Analytics 4: Behavioral Modeling Thresholds
GA4 behavioral modeling requires all of the following to be met:
- Advanced consent mode implemented on all pages
- Tags loaded before the consent dialog appears
- At least 1,000 events per day with analytics_storage='denied' for at least 7 days
- At least 1,000 daily users with analytics_storage='granted' for at least 7 of the previous 28 days
- Reporting Identity set to "Blended" in GA4 Admin → Data Display → Reporting Identity
TCF limitation: When users deny consent via an IAB TCF v2.0 implementation, GA4 is unable to model data to fill in missing information.
GA4 consent mode reference: Consent mode on websites and apps — Google Analytics Help
Troubleshooting Google Consent Mode v2: Common Problems and Fixes
The following issues represent the most common GCM v2 implementation problems, including late consent, unknown states, and race conditions that cause (not set) attribution in GA4.
Problem 1: Tags Fire Before Consent Is Set (Race Condition)
Symptom: Tag Assistant shows "a tag read consent before a default was set." GA4 shows (not set) for session source/medium on a high percentage of sessions, even for users who granted consent.
Root cause: The gtag('consent', 'default', {...}) command is executing after the GTM container or Google tag snippet has already initialized and begun reading consent state.
Fix:
- Ensure Secure Privacy script script appears before the GTM snippet or any Google tag script in your page —not after.
- Add 'wait_for_update': 500 inside your default consent command (see the wait_for_update section above).
- In GTM: confirm the Consent Initialization trigger is used for Secure Privacy - please do not use the DOM Ready or Window Loaded triggers for Secure Privacy; the same way - make sure NO other tag is using the Consent Initialization trigger - only Secure Privacy - as this trigger is specifically designed to be used exclusevely by Consent Management Platforms, like Secure Privacy.
Problem 2: Late Consent — User Grants Consent After Initial Page Load
Symptom: Users who accept the banner after reading the page are still showing as (not set) in GA4 session source. session_start and first_visit events are missing for these users.
Root cause: In Advanced mode, GA4 can retroactively process events collected on the same page after consent is granted—but only if the default consent command (fired automatically be Secure Privacy) - gtag('consent', 'update', {...}) - fires before the user navigates away from the page. If the page transition happens before the update, the session attribution is permanently lost for that session.
What Google's October 2024 update improved: Google launched backend improvements allowing GA4 to retroactively apply session and identity context to events triggered before consent was granted, as long as the consent update fires on the same page. This significantly reduces, but does not eliminate, the (not set) attribution problem for late-consent scenarios.
Fix:
- Ensure your Secure Privacy fires default consent command - gtag('consent', 'update', {...})
(no race condition with other async / Google scripts)
- Implement a GA4 Config tag on the Consent Initialization trigger with send_page_view: false. This ensures the config is registered before GA4 events fire, preserving session context even for late-consent users.
- Since November 13, 2024, Google requires a config command before custom events are processed. Fire the Config tag on "Initialization" with send_page_view: false as a best practice to ensure this is always satisfied.
Problem 3: Unknown Consent State — gcd Parameter Shows l
Symptom: When inspecting network requests in the browser developer tools, the gcd parameter in Google's ping URLs contains l (lowercase L). Conversion modeling is not activating. GA4 attribution is mostly (not set).
Root cause: The gcd=l value means the consent signal has not been set with Consent Mode at all—neither granted nor denied. The most common causes are: the consent default script is missing from one or more page templates, for some reason Secure Privacy is not firing gtag('consent', 'update') when the user makes a choice, or the page has a custom event that fires before any consent initialization.
Fix:
- Audit every page template (including landing pages, thank-you pages, and error pages) to confirm Secure Privacy is running there and that the default consent event is firing as expected.
- Use Google's Consent Mode debugging guide and the Tag Assistant Chrome extension to verify the consent state on each page type.
- Use window.parent.google_tag_data.ics object to confirm the wasSetLate is false.
Open DevTools → Console and run window.parent.google_tag_data.ics to inspect the live consent state object. wasSetLate: false confirms that consent defaults were set before any Google tag fired — no race condition is present. If you see wasSetLate: true, move Secure Privacy script higher above in the section or at least above your GTM snippet and increase wait_for_update.
Problem 4: Users Who Never Interact With the Banner
Symptom: A significant portion of sessions show no consent signal at all. Analytics and ad measurement for these sessions is entirely missing.
Root cause: Users who scroll past or close the page without interacting with the consent banner remain in the default consent state indefinitely. In Advanced mode with 'denied' as the default, cookieless pings continue to be sent throughout their session—which feeds modeling. In Google Consent Basic mode - no data is sent.
Fix:
- If you are using Basic mode and this scenario matters for your measurement, evaluate switching to Advanced mode. See Google Consent Mode: Basic vs. Advanced — Complete Guide for the trade-offs.
- Ensure the consent default command is on every page so that modeling can apply to these sessions. You can use the snippet below - set it as high and above as possible of any other script -
- Audit banner UX—a banner that is immediately dismissible without a clear choice leads to more unresolved consent states.
Problem 5: URL Passthrough Parameters Causing Site Errors
Symptom: After enabling url_passthrough, certain pages break, redirect incorrectly, or display wrong content. Analytics shows inflated unique page counts.
Root cause: Your application is reading URL query parameters for routing, content selection, or filtering logic. The _gl or gclid parameters appended by URL Passthrough are being interpreted as application parameters.
Fix:
- Audit your application's URL parameter handling. Ensure gclid, dclid, gclsrc, _gl, and wbraid are explicitly ignored or passed through by your routing logic.
- Configure GA4 to exclude these parameters from page URL reporting (Admin → Data Streams → Additional Settings → List unwanted referrals / excluded domains is not the right place—use a data filter or configure GTM to strip them from the page_location variable).
- Ensure any server-side redirects preserve all five URL Passthrough query parameters.
- If the site issues cannot be resolved, consider disabling URL Passthrough and relying on conversion modeling instead.
Problem 6: Consent Mode Status Not Appearing in Google Ads
Symptom: You have implemented GCM v2 but the consent mode status in your Google Ads account still shows as not configured or pending.
Fix:
- Allow 48 hours after correct implementation—this is normal. Full status may take up to 2 weeks.
- Make sure Secure Privacy is installed correctly on all pages, with Google Consent Mode Advanced enabled in the UI under Domain -> Settings -> Advanced
To enable Google Consent Mode Advanced in Secure Privacy, go to Domain Settings → Advanced tab → Google Consent Mode and complete three steps:
- Enable the Google Consent Mode master toggle
- Enable Advanced mode
- Configure default consent states per region — set all consent types to denied for EEA countries and granted for all other regions
Additionally:
- Verify the gcs parameter in your network requests. G100 = both denied, G101 = analytics denied/ads granted, G110 = analytics granted/ads denied, G111 = both granted. See How to Check If Google Consent Mode Is Working for the full gcs parameter reference.
- Confirm your Google Ads account is linked to the same Google tag or GTM container that has GCM v2 configured.
- Confirm GCM v2 is active on your live site using Tag Assistant: open tagassistant.google.com, enter your URL, and inspect the Consent tab for each tag.
Debugging reference on Google Tag Documentaion - Consent mode debugging — Google Tag Platform documentation
Frequently Asked Questions
Is Google Consent Mode v2 mandatory?
Yes, for any website using Google advertising products (Google Ads, Display & Video 360, Search Ads 360, Floodlight) with traffic from the European Economic Area (EEA) or the United Kingdom. Google made GCM v2 mandatory on March 6, 2024, and began actively restricting conversion tracking and audience creation for non-compliant accounts on July 21, 2025.
What are the four main Google Consent Mode v2 parameters?
The four core parameters required for GCM v2 compliance are: ad_storage (controls advertising cookies and device IDs), analytics_storage (controls analytics cookies and session tracking), ad_user_data (controls sending user data to Google for advertising, including Enhanced Conversions), and ad_personalization (controls remarketing and personalized advertising). The first two were present in v1; the last two are new in v2.
What is url_passthrough in Google Consent Mode?
url_passthrough is a GCM v2 configuration parameter that, when set to true, appends ad click identifiers (GCLID, DCLID, _gl, wbraid, gclsrc) as URL query parameters to internal links on your site. This preserves conversion attribution and session continuity across page navigations when ad_storage is denied and cookies cannot be used. It enables cookie-free attribution for same-domain navigation only.
What is ads_data_redaction in Google Consent Mode?
ads_data_redaction is a privacy enhancement parameter that, when set to true and ad_storage is 'denied', removes all ad click identifiers (GCLID, DCLID) from network requests to Google's servers, routes requests through a cookieless domain, and ensures no advertising cookies are read or written. It has no effect when ad_storage is granted. It is the highest-privacy option for handling ad data when users decline consent.
Should I enable url_passthrough or ads_data_redaction?
They serve opposing purposes. Enable url_passthrough=true when maximizing conversion measurement is the priority—it keeps click identifiers in URL parameters when cookies are unavailable, enabling better attribution. Enable ads_data_redaction=true when maximizing user privacy is the priority—it removes all click identifiers from Google's servers entirely. Both can be enabled simultaneously; when combined with ad_storage='denied', the click ID will travel in URLs for internal navigation but will be redacted from all network requests to Google. Always consult legal counsel on the GDPR implications of URL Passthrough for EEA users before enabling it as a default for non-consented users.
What is the difference between Google Consent Mode Basic and Advanced?
In Basic mode, Google tags are completely blocked from firing when consent is denied—no data is sent to Google at all. Conversion modeling uses only a general, non-advertiser-specific model. In Advanced mode, Google tags load but operate in a restricted, cookieless mode. Cookieless pings are sent even when consent is denied, feeding advertiser-specific conversion and behavioral modeling. Advanced mode typically recovers 15–25% of otherwise lost conversion data through modeling, but requires careful legal review since data is sent to Google from users who have not explicitly opted in.
What happens when ad_storage is denied in Google Consent Mode?
When ad_storage='denied': no new advertising cookies are written or read; requests are sent through a different, cookieless domain; Google Signals does not accumulate data; IP addresses are truncated at collection; full page URLs are still collected (including GCLID if present), unless ads_data_redaction=true is also set. In Advanced mode, cookieless pings are sent containing limited signals used for conversion modeling.
Why do I have (not set) traffic source in GA4 after adding a consent banner?
The most common causes of (not set) traffic source/medium in GA4 after adding a consent banner are: (1) session_start and first_visit events firing before the consent default is set, meaning GA4 cannot associate them with a session; (2) tags firing before the CMP loads (a race condition)—fixed by adding wait_for_update: 500 to your consent default; (3) the consent config command missing, causing GA4 to not register a session before events fire. Fire a GA4 Config tag on "Consent Initialization" with send_page_view: false to resolve the session registration issue.
Is url_passthrough GDPR compliant?
This is legally uncertain. Google positions URL Passthrough as a privacy-respecting alternative to cookie storage for use when consent is denied. However, GCLID is a unique identifier tied to an individual ad click, and some Data Protection Authorities may consider it personal data under GDPR Article 4(1)—which would mean processing it without explicit consent is non-compliant. Google's documentation does not explicitly address this question. Consult your legal counsel before enabling URL Passthrough as a default behavior for EEA users who have denied consent.
How do I check if Google Consent Mode v2 is working?
The easiest starting point is the Consent Mode Inspector by InfoTrust — install it, visit your site, and it displays the active consent state for every parameter in a clear UI without needing to read network requests. For a deeper check, open DevTools → Network tab and filter for Google tag requests. Look for the gcs parameter: G100 = both ad_storage and analytics_storage denied; G101 = analytics denied, ads granted; G110 = analytics granted, ads denied; G111 = both granted. Also check the gcd parameter—l means no consent signal was set at all. For a full step-by-step walkthrough of both methods, see How to Check If Google Consent Mode Is Working.
Related Articles
- How to Implement Google Consent Mode Advanced with GTM
- Google Consent Mode: Basic vs. Advanced — Complete Guide
- How to Check If Google Consent Mode Is Working
- How to Implement Google Consent Mode Basic
- How to Set Up Secure Privacy CMP via Google Tag Consent Mode
- How to Comply with Google's EU User Consent Policy
- Google Consent Mode v2 Advanced Setup with Secure Privacy
- Secure Privacy: Google-Certified Consent Management Platform
---
# How to Set Up Extra Consents and a Budget Limit in Secure Privacy
URL: https://support.secureprivacy.ai/article/how-to-set-up-extra-consents-and-a-budget-limit-in-secure-privacy
Product: Consent Management
Category: Policies & User Consent
Published: 2026-04-14T11:57:00+00:00
Updated: 2026-04-15T18:12:10.787+00:00
Reading Time: 6 minutes
Summary: Learn how to configure extra consent packages and set a monthly budget limit in Secure Privacy so your cookie banner never stops recording consents.
Configure automatic extra consent packages so your cookie banner keeps recording visitor choices — even after you exceed your plan's monthly limit.
If your website traffic is growing, there is a good chance you will eventually hit the monthly consent limit included in your Secure Privacy plan. When that happens, your cookie consent banner still appears to visitors, but new consents are only stored in the browser — they are not recorded in the Secure Privacy database. That gap can make GDPR, CCPA, and ePrivacy audits harder, because you lose the centralised proof-of-consent record regulators expect.
Some consent management platforms force you to upgrade to a more expensive tier the moment you exceed your quota. Secure Privacy takes a different approach: Extra Consent Packages. You set a monthly budget cap, and the system automatically activates additional blocks of 100,000 consents at $10 / €10 each — only when you actually need them. No surprise bills, no plan changes, and no interruption to consent recording.
By the end of this guide you will know exactly how the extra consent feature works, how to configure your budget limit, and what to expect on your invoice.
Who Is This For?
This article is for Secure Privacy customers on a paid monthly or annual plan who want to keep consent recording active after reaching their plan's included consent volume. The Extra Consents feature is not available during a free trial or on the Free plan.
Prerequisites
Before you begin, make sure you have an active paid subscription (monthly or annual) and access to the Billing page in your Secure Privacy dashboard. You will also need a valid payment method on file, since extra consent charges are billed automatically.
What Happens When You Reach Your Consent Limit
Once your recorded consents hit the monthly cap included in your plan, two things change:
The banner keeps showing. Visitors still see your cookie consent banner and can accept or decline cookies as usual. However, those consent records are only saved locally in the visitor's browser — they are not sent to the Secure Privacy database. This means your compliance proof has a gap until the counter resets.
The counter resets automatically. At the end of each billing period, Secure Privacy resets your consent counter and normal database recording resumes. You do not need to do anything manually.
The Current Plan panel shows your consent usage at a glance.
How to Configure Your Extra Consent Budget
Step 1 — Open Billing Settings
Log in to your Secure Privacy dashboard and navigate to the Billing page. Scroll down to the Extra Consents Settings panel.
Step 2 — Set a Monthly Budget Limit
Enter the maximum amount (in USD or EUR) you are willing to spend on extra consents each month. Each consent package costs $10 / €10 per 100,000 consents. For example, setting a budget of $30 allows up to three additional packages (300,000 extra consents) per billing cycle. If your budget is lower than $10, no extra packages will activate.
The default value for all accounts is $0 (feature disabled).
Enter your monthly budget cap in the Extra Consents Settings panel under Billing.
Step 3 — Save and Confirm
Click Save. From this point forward, Secure Privacy will automatically activate an extra consent package whenever your recorded consents exceed the plan limit — as long as your remaining budget covers the next $10 / €10 package.
How Extra Consent Packages Are Activated and Billed
Automatic Activation
When a visitor accepts or declines cookies and that consent pushes your count past the plan limit (plus any previously activated extra consents), the system checks your budget. If there is enough budget remaining, a new package of 100,000 consents is activated instantly, and the consent is recorded to the database without interruption.
First-Activation Email
The first time an extra package activates in a billing cycle, Secure Privacy sends you an email notification. This is a one-time alert per cycle so you know overage recording has begun. No action is required on your part — the charge will appear on your next invoice automatically.
Invoicing for Monthly Plans
For monthly subscriptions, a usage-based line item is added to your existing subscription. You will see it on the Billing page under Active Payment Items with the current quantity of activated packages. The charge appears on your regular monthly invoice alongside your plan fee.
Invoicing for Annual Plans
Annual subscriptions handle extra consents slightly differently. Instead of attaching a usage-based product to the subscription, Secure Privacy generates a separate invoice every 30 days for any extra consent packages used during that period. These invoices appear in your Billing History list and are charged to the payment method on file.
What Happens After You Change or Remove the Budget
You can update your budget limit at any time. If you reduce it to $0 (or remove it entirely) after packages have already been activated in the current cycle, those packages remain active until they are used up. The consents already allocated will continue to be recorded, and the corresponding charge will still appear on your next invoice. No consents are lost.
From the next billing cycle onward, no new packages will activate unless you set a budget again.
Troubleshooting
I set a budget but consents are still not being recorded
Make sure your budget is at least $10 / €10. Any amount below the cost of a single package will not trigger activation. Also confirm that your payment method is valid and has not expired.
I do not see the Extra Consents Settings panel
The panel is only visible on paid plans. If you are on a free trial or the Free plan, you will need to upgrade before the option appears.
My annual plan invoice does not show extra consent charges
For annual plans, extra consent charges are billed on separate invoices generated every 30 days — not on the main subscription invoice. Check your Billing History and adjust the date filter if needed, as these invoices may be dated slightly ahead of the current date.
Frequently Asked Questions
What happens when I exceed my cookie consent limit?
Your cookie banner continues to appear, but consents are only stored locally in the visitor's browser — they are not recorded in the Secure Privacy database. Enabling extra consent packages prevents this gap by automatically activating additional recording capacity.
How much do extra consent packages cost?
Each extra package provides 100,000 additional consents for $10 or €10. Packages are only activated when needed and only if your monthly budget allows it — you will never be charged more than the limit you set.
Can I use extra consents on a free trial or Free plan?
No. The Extra Consents feature is available only on paid monthly or annual plans. You will need to upgrade before you can set a budget limit.
Do extra consent charges differ between monthly and annual plans?
The per-package price is the same. The difference is in billing: monthly plans add the charge to your regular subscription invoice, while annual plans generate a separate invoice every 30 days for any extra consent usage.
What if I lower my budget mid-cycle after packages have activated?
Already-activated packages stay active until the consents are used up, and the charge still applies to your next invoice. New packages will not activate once the budget is reduced below the required threshold.
Related Articles
- Understanding Your Billing and Invoices
- How to Upgrade Your Secure Privacy Plan
- Consent Recording and Proof of Consent
- GDPR Cookie Consent Compliance Guide
---
# Why Cookies Are Still Visible After Declining Consent — And Why That Means Tracking Is Stopped
URL: https://support.secureprivacy.ai/article/why-cookies-are-still-visible-after-declining-consent-and-why-that-means-trackin
Product: Consent Management
Category: FAQs
Published: 2026-04-13T08:28:00+00:00
Updated: 2026-04-13T09:24:10.915+00:00
Reading Time: 12 minutes
Summary: Declining tracking consent doesn't delete cookies — and that's fine. Learn how script-blocking stops data collection, why cookies persist, and how to verify it in the Network tab.
You open your browser's developer tools, decline tracking on a website, and check the Storage or Application panel — and the cookies are still sitting there. That feels wrong. You said no. Shouldn't they be gone?
This is one of the most common sources of confusion around GDPR cookie consent, and it trips up developers and privacy-conscious users alike. The assumption is that consent = cookie deletion. In reality, that is not how tracking works — and understanding the difference is the key to knowing whether your consent solution is actually protecting your users.
Many cookie banners on the market lean into this misunderstanding and attempt to delete cookies on opt-out. The problem? It is technically and physically impossible for a web page to delete cookies it does not own. Browsers enforce this as a hard security boundary — a page on example.com cannot reach into storage belonging to analytics-vendor.com. Any tool claiming otherwise is either deleting only its own first-party cookies (and missing the rest) or giving you a false sense of compliance.
The correct mechanism for stopping tracking is script blocking: preventing the third-party JavaScript from loading and running in the first place. Secure Privacy works exactly this way. When a visitor declines a consent category, the associated tracking scripts are never injected — so no data is collected, no data is sent, and no GDPR violation occurs. The cookie files that may already exist locally are inert: there is no code running to read them, package them, or transmit them anywhere.
By the end of this article you will understand why cookies persist after a user opts out, why that is fine when script-blocking is in place, how to verify in the Network tab that tracking has genuinely stopped, and the one extra step users should take after declining consent to guarantee a clean state.
Who Is This Article For?
This guide is useful for:
- Website owners and developers who want to verify that their Secure Privacy implementation is blocking tracking correctly after a user opts out.
- Privacy officers and compliance teams who need to understand why cookie files remaining in storage does not constitute a GDPR violation when scripts are blocked.
- End users who declined tracking consent on a website and want to confirm their data is not being sent to third parties.
- QA testers checking consent behaviour across browser sessions.
The Two Browser Security Boundaries You Cannot Cross
Before diving into the verification steps, it helps to understand the two hard limits that browsers enforce. Both exist for your users' security — and both explain exactly why cookie-deletion-based "consent" is a fundamentally broken approach.
1. Cross-Origin Cookie Ownership
Every cookie belongs to the origin (domain) that set it. A script running on yoursite.com cannot read, modify, or delete a cookie that was set by googletagmanager.com, facebook.com, or any other third-party domain. This is the Same-Origin Policy — a foundational browser security rule. If this boundary could be crossed, any website could silently wipe authentication tokens or session data set by your bank.
The practical consequence: no cookie consent solution — not one — can reliably delete third-party tracking cookies, because the browser will not allow it. What some tools delete is only the first-party cookie proxies they themselves placed. The real third-party tracking cookies remain untouched in storage.
2. In-Memory JavaScript Cannot Be Evicted by Other Scripts
When a JavaScript file is loaded by the browser, it is compiled and placed into the browser's memory space. A separate script — even one from the same page — cannot reach into that memory and unload or overwrite it. Attempting to do so would be a serious security vulnerability. This is why a consent banner that appears after a tracking script has already loaded cannot "undo" what that script did: the code is already in memory and may have already fired its data-collection routines.
The practical consequence: even with correct script-blocking in place, if a user declines consent on a page where a tracking script was loaded during a previous session, the safest action is to refresh or navigate to a new page. This clears the memory space entirely, and on the fresh page load, the blocked scripts will not be injected at all.
How Script-Blocking Actually Stops Tracking (Even When Cookies Remain)
Think of cookies as a paper notepad left on a desk. Tracking does not happen because the notepad exists — it happens because a person (the JavaScript code) picks it up, reads it, and sends the information somewhere. If you prevent that person from entering the room, the notepad becomes irrelevant. The data sits there, locally, never read, never transmitted.
This is exactly what Secure Privacy does when a user declines a consent category:
- The associated third-party script tags are not injected into the page.
- No JavaScript from that vendor runs in the browser.
- No data — including the contents of any locally stored cookies — is read or transmitted.
- From a data privacy and GDPR compliance standpoint, no tracking is occurring.
The cookies that remain in the browser's storage are a local artefact with no active reader. They were written by previous sessions (or by the browser itself as part of browser functionality) and will eventually expire naturally. Their presence is not evidence of ongoing tracking — it is simply the browser's normal storage behaviour.
Compliance note: GDPR and ePrivacy regulations prohibit the collection and processing of personal data without consent. A cookie file sitting in local storage, unread and untransmitted, does not constitute processing. What constitutes processing is the script reading it and sending it to a remote server — and that is precisely what script-blocking prevents.
The Correct Way to Verify That Tracking Is Stopped After Declining Consent
Follow these steps to confirm that Secure Privacy is correctly blocking tracking scripts after a user declines consent. The Network tab in your browser's developer tools is the definitive source of truth.
Step 1 — Open the Browser's Developer Tools and Go to the Network Tab
On any modern browser (Chrome, Firefox, Edge, or Safari), press F12 or right-click anywhere on the page and select Inspect. Navigate to the Network tab. This panel records every HTTP request the browser makes — including requests from tracking scripts sending data to third-party servers. Keep this tab open throughout the test.
Step 2 — Load the Page Fresh and Note Which Scripts Are Present
Reload the page with the Network tab open. Before interacting with the consent banner, observe which third-party requests appear. You may see calls to Google Analytics, Meta Pixel, LinkedIn Insight, or other tracking vendors. This is your baseline: what the page loads before consent is given or declined.
Before declining — tracking requests to third-party vendors are visible in the Network tab, confirming scripts are active and data is being sent.
Step 3 — Decline the Relevant Consent Categories
Interact with the Secure Privacy consent banner and decline the tracking or analytics categories you want to verify. Click Save preferences or the equivalent confirmation button to register your opt-out choice.
Step 4 — Refresh the Page or Navigate to Another Page
This is a critical step. As explained above, any JavaScript already loaded into the browser's memory during this session cannot be forcibly evicted by another script. By refreshing or navigating to a new page, you clear the memory space entirely. On the fresh load, Secure Privacy will evaluate the stored consent decision and will not inject the declined scripts.
After declining consent and refreshing — the Network tab returns no results for the tracking vendor domain. The script is not loaded; no data is collected or transmitted.
Step 5 — Verify in the Network Tab That Blocked Scripts Are Absent
With the Network tab still open, examine the requests on the freshly loaded page. The tracking scripts associated with the declined categories should no longer appear in the request list. If a script is not loaded, it cannot collect data or send anything to a remote server — tracking has stopped. You can use the Filter field in the Network tab to search for specific vendor domains (e.g., google-analytics.com, facebook.net) to confirm their absence.
Step 6 — Ignore Cookie Files in the Storage / Application Panel
If you switch to the Application (Chrome/Edge) or Storage (Firefox) panel, you may still see cookies from previous sessions. As explained in this article, these are local artefacts. Because the scripts that would read and transmit them are not running, these cookies are inert. Their presence is expected and does not indicate tracking is occurring. The Network tab is the only reliable indicator of active tracking.
What Happens to the Remaining Cookie Data?
Cookie files left in local storage after a user opts out will remain there until one of the following occurs:
- The cookie reaches its natural expiry date and the browser removes it automatically.
- The user manually clears their browser's cookies and site data.
- The browser itself removes it as part of storage quota management or privacy mode behaviour.
None of these scenarios involve your website transmitting data. The consent choice stored by Secure Privacy ensures that, for every subsequent page load, the tracking scripts remain blocked. The leftover cookies are permanently without an active reader for as long as the user's opt-out consent decision is in place.
Troubleshooting: Scripts Still Appearing After Opt-Out?
If you decline consent, refresh the page, and tracking scripts are still appearing in the Network tab, work through the following checks before contacting support.
Check: Did you refresh or navigate after declining?
The decline takes effect on the next page load. If you checked the Network tab immediately after clicking "Decline" without refreshing, you will still see the scripts from the current session's memory. Refresh and test again.
Check: Is the script being loaded by another un-gated script?
Some tag managers (e.g., Google Tag Manager) load tracking scripts dynamically. If GTM itself is not gated by consent, it may inject sub-scripts regardless of Secure Privacy's settings. Ensure your GTM container is itself wrapped in a consent check, or use Secure Privacy's native GTM integration to manage this correctly.
Check: Are you testing in a private/incognito window?
Private windows do not share cookie storage with regular windows, which means any previously stored consent decision will not carry over. The consent banner may appear fresh, potentially with default consent state. Test in a regular browser window where your opt-out decision has been saved.
If none of the above resolves the issue, contact Secure Privacy support[?] with a screen recording of the Network tab behaviour and your site URL so we can investigate your specific implementation.
Frequently Asked Questions
Why are cookies still showing after I declined consent?
Cookies are small files stored by the browser, and browsers enforce a security rule that prevents one website from deleting files that belong to another. So cookies set by third-party tracking vendors in previous sessions will remain in your browser's storage even after you decline consent. What changes after you decline is that the scripts which read those cookies and send data to remote servers are blocked. With no active script, the cookie files are harmless local data that will expire naturally over time.
Does declining cookie consent actually stop tracking?
Yes — when implemented correctly via script-blocking (as Secure Privacy does). Tracking happens because JavaScript code runs in your browser, reads identifiers stored in cookies or memory, and transmits that data to a third-party server. When the script is blocked, that entire chain is broken. The cookie files that remain are never read or transmitted, so no tracking occurs. You can confirm this by checking the Network tab in your browser's developer tools after declining and refreshing: the tracking vendor's domain should not appear in any outbound requests.
Why do I need to refresh the page after declining consent?
JavaScript that was already loaded into the browser's memory during the current page session cannot be removed by another script — this is a browser security boundary. If a tracking script loaded before you declined consent, it may still be sitting in memory for the rest of that page session. Refreshing the page (or navigating to a new page) clears the memory entirely. On the next load, Secure Privacy reads your saved consent decision and does not inject the declined scripts, guaranteeing a clean, tracking-free session.
How can I check whether tracking scripts are really blocked?
Use the Network tab in your browser's developer tools (press F12, then click Network). After declining consent and refreshing the page, check whether requests to tracking vendor domains (such as google-analytics.com, facebook.net, or similar) appear in the request list. If those domains are absent, the scripts are blocked and no data is being transmitted. The Storage or Application panel showing residual cookie files is not a reliable indicator — always use the Network tab.
Is it a GDPR violation if cookies remain in storage after opt-out?
No. GDPR and ePrivacy regulations regulate the collection and processing of personal data. A cookie file sitting in a user's local browser storage, unread by any script and never transmitted to any server, does not constitute processing. The violation would occur if a script were actively reading that cookie and sending its value to a third party — which is exactly what script-blocking prevents. Cookie files left over from previous sessions, with no active reader, are outside the scope of GDPR processing requirements.
Can a cookie consent banner delete third-party cookies?
No. Browsers enforce the Same-Origin Policy, which prevents any script from deleting or modifying cookies set by a different domain. A consent banner running on your site cannot delete cookies that belong to Google, Meta, or any other third-party vendor. Tools that claim to "delete" cookies on opt-out are typically only deleting first-party cookies they themselves set, while leaving third-party tracking cookies intact — giving a false sense of compliance. The correct approach is to block the tracking scripts from loading in the first place, which is how Secure Privacy operates.
Related Articles
- How Secure Privacy Blocks Tracking Scripts by Consent Category
- Adding Third-Party Scripts to Consent Control[?]
- Using Secure Privacy with Google Tag Manager Consent Mode
- GDPR Compliance Checklist for Website Owners
- How to Test and Verify Your Consent Implementation
---
# How to Set Up Secure Privacy CMP via Google Tag Consent Mode
URL: https://support.secureprivacy.ai/article/how-to-set-up-secure-privacy-cmp-via-google-tag-consent-mode
Product: Consent Management
Category: Google Consent Mode
Published: 2026-04-09T09:09:00+00:00
Updated: 2026-04-09T21:25:34.549+00:00
Reading Time: 6 minutes
Summary: Connect Secure Privacy as your consent management platform directly in Google Ads or Tag Manager. Step-by-step Google Tag consent mode setup — no code required.
Google now requires websites using Google Ads, Analytics, and other Google tag products to implement consent mode before collecting data from users in regions covered by the GDPR, ePrivacy Directive, and similar privacy laws. Without a properly configured consent management platform (CMP), your Google tags default to restricted data collection — reducing conversion measurement accuracy, limiting remarketing audiences, and leaving gaps in your analytics.
You could wire up consent signals manually with gtag('consent', 'update', ...) calls, maintain your own cookie banner, and hope the implementation stays in sync every time Google updates its consent API. Or you could use a CMP that Google has fully integrated into the Google Tag platform itself — letting you connect, configure, and go live without writing a single line of consent code.
Secure Privacy is one of the CMPs listed as a fully integrated platform inside Google's consent mode setup wizard. That means Google handles the wiring: no manual gtag consent configuration, no extra scripts to maintain, and a free tier to get started. This guide walks you through every step of connecting Secure Privacy as your CMP directly within Google Ads or Google Tag Manager.
Who Is This For
This guide is for website owners, marketing teams, and ad-ops professionals who manage a Google tag (via Google Ads, Google Analytics, or Google Tag Manager) and need to set up Google Consent Mode v2 with a compliant cookie consent banner. It is especially relevant if you are setting up consent mode for the first time or switching from a manual implementation to a fully integrated CMP.
Prerequisites
- Access to the Google Ads or Google Tag Manager account that owns the Google tag you want to configure. The tag can be associated with Google Ads, Google Analytics, or any other Google product — the key requirement is admin-level access to the tag itself.
Step-by-Step: Connect Secure Privacy to Your Google Tag
Step 1 — Open the Google Tag Admin Settings
In Google Ads: Navigate to Tools in the left sidebar, then open Data manager. Click into your Google tag to open its settings panel and select the Admin tab along the top.
Google Ads — navigating to the Google tag Admin tab via Data manager.
The Google tag panel inside Data manager displays connected products and the Admin tab.
In Google Tag Manager: Navigate to the Google tags tab under your account. Select your tag from the list, click into it, and choose the Admin tab along the top.
Google Tag Manager — select your tag from the Google tags list.
Step 2 — Click "Set Up Consent Mode"
Under the Google tag management section on the Admin tab (click "Show more" if the option is not showing right away), click Set up consent mode. This opens a setup wizard that walks you through connecting a CMP to your Google tag.
The Admin tab with the "Set up consent mode" option visible under Google tag management.
Step 3 — Select Your Consent Banner Type
On the first screen of the wizard you will be asked "Which type of consent banner do you have?" Select "I don't have a consent banner", then click Next. This tells Google you want to set up a new banner through a third-party CMP.
Select "I don't have a consent banner" to proceed with the CMP integration flow.
Step 4 — Open the Third-Party Platform Picker
The next screen, titled "Set a third-party banner," explains the role of consent banners and CMPs. Click the "Select your platform" button to open the platform picker panel. Click "Select your platform" to browse available fully integrated CMPs.
Step 5 — Choose Secure Privacy as Your CMP
A side panel titled "Select a third-party platform (to create your banner)" will appear. Under the Fully integrated platforms section, find and select Secure Privacy (listed with "Free tier available"). Follow any remaining on-screen prompts to complete the integration.
Secure Privacy appears as a fully integrated platform in Google's CMP picker.
Step 6 — Confirm Setup and Publish Your Consent Banner
After selecting Secure Privacy, the wizard confirms your consent signals are active and shows your CMP account details. From this screen you can publish your consent banner by selecting a Google Tag Manager container or installing manually. Choose the publishing method that fits your workflow and follow the on-screen prompts to go live.
Setup confirmation — Secure Privacy is connected and consent signals are active.
Important Notes and Troubleshooting
- Secure Privacy is listed as a fully integrated platform, which means Google has a direct integration path — no manual gtag consent configuration is required on your end.
- If the Google tag gateway shows as "Incomplete" on the Admin page, that is a separate first-party tagging concern and does not block consent mode setup.
- After completing setup, use the "Test your consent signals" section (available on the first screen of the wizard) to verify that consent state is being communicated correctly to the Google tag.
- If the consent signal test does not detect your banner, confirm that the Secure Privacy script is loading on your site and that you have published the consent banner to the correct domain.
What Happens After Setup
Once Secure Privacy is connected through Google's consent mode wizard, your Google tags will automatically respect the consent choices visitors make through the Secure Privacy cookie banner. Consent signals for ad_storage, analytics_storage, ad_user_data, and ad_personalization are communicated to Google in real time. Google's conversion modeling fills measurement gaps for visitors who decline consent, preserving advertising performance data without compromising privacy compliance.
Frequently Asked Questions
Do I need Google Consent Mode if my site targets EU visitors?
Yes. If your site uses Google tags (Ads, Analytics, or others) and serves visitors in the EU or EEA, implementing consent mode ensures your tags respect user consent choices as required by the GDPR and ePrivacy Directive. Without it, Google restricts data collection by default.
Is Secure Privacy free to use with Google Consent Mode?
Secure Privacy offers a free tier that is available directly through Google's consent mode setup wizard. You can create an account and connect your CMP without leaving the Google Ads or Tag Manager interface.
Do I need to add any code to my site for this integration?
No. Because Secure Privacy is a fully integrated platform in Google's system, the consent mode wiring is handled automatically. You still need to publish the consent banner to your site (either manually or via Google Tag Manager), but no manual gtag('consent', ...) code is required.
What is the difference between a fully integrated CMP and a manual setup?
A fully integrated CMP like Secure Privacy has a direct integration path built into Google's tag platform. Google handles the consent signal configuration automatically. With a manual setup, you must write and maintain your own gtag consent commands, which increases implementation complexity and the risk of misconfiguration.
Related Articles
- Understanding Google Consent Mode v2
- Install Secure Privacy via Google Tag Manager
- How the Secure Privacy Cookie Scanner Works[?]
- Setting Up Cross-Domain Consent Sharing
---
# How to Find Your Domain ID in Secure Privacy
URL: https://support.secureprivacy.ai/article/how-to-find-your-domain-id-in-secure-privacy
Product: Consent Management
Category: Getting Started
Published: 2026-04-06T18:46:00+00:00
Updated: 2026-04-06T20:03:45.558+00:00
Reading Time: 5 minutes
Summary: Learn where to find your Domain ID in the Secure Privacy dashboard. Step-by-step guide for connecting integrations, APIs, and consent banner scripts.
Setting up an integration, embedding a consent banner script, or following a Secure Privacy help article — and suddenly everything asks for a Domain ID you can't find? You're not alone. The Domain ID is a unique identifier assigned to each website you manage inside Secure Privacy, and it's referenced throughout our documentation, API guides, and advanced configuration workflows. Without it, integrations stall and custom implementations can't connect to the right consent configuration.
Generic cookie consent plugins and manual script setups don't have this concept at all — which means when you move to a proper consent management platform like Secure Privacy, the Domain ID is a new piece of the puzzle. The good news: it takes about fifteen seconds to find once you know where to look.
This guide shows you exactly where your Domain ID lives in the Secure Privacy dashboard, how to copy it, and where you'll typically use it.
Who Is This For?
This article is for anyone using Secure Privacy who needs to:
- Connect a third-party integration that requires a Domain ID
- Make API calls scoped to a specific domain in their account
- Follow a Secure Privacy setup guide that references the Domain ID
- Troubleshoot a consent banner that isn't loading on the correct domain
What Is a Domain ID?
Every website (domain) you add to your Secure Privacy account is assigned a unique Domain ID — a short alphanumeric string that identifies that specific domain's consent configuration within the platform. It is distinct from your account ID and is scoped to a single domain, so if you manage multiple websites you will have a separate Domain ID for each one.
The Domain ID is used in contexts such as:
- API requests that read or write consent data for a specific domain
- Custom script implementations referencing a domain's consent settings
- Integration configurations (e.g., Google Tag Manager, Tealium, or other platforms)
- Support requests when our team needs to locate your domain configuration
How to Find Your Domain ID
Step 1 — Log in to your Secure Privacy account
Go to secureprivacy.ai and click the "Sign in" link in the top navigation bar, use your credentials. You will land on the main dashboard.
Step 2 — Open Domain Settings for the relevant website
In the left-hand navigation, click Websites (or select your domain from the account switcher at the top of the sidebar if you manage multiple sites). This opens the domain overview for that website.
The Websites section lists all domains in your account.
Step 3 — Navigate to Domain Settings
With the correct domain selected, click Installation in the domain-level navigation. This opens the domain configuration panel.
Click Settings in the domain navigation to open domain configuration.
Step 4 — Locate and copy your Domain ID
In the Domain Settings panel, your Domain ID is displayed in the URL (see screenshot).
Alternatively, Domain ID is "included" into the installation script URL - click the script link to add it to your clipboard, paste it into notepad and fetch the numeric domain ID, for example, for this script URL -
the domain ID would be
606acb2d5761b5f013b48067What to Do With Your Domain ID
Once you have your Domain ID, here are the most common places you'll use it:
- Google Tag Manager setup — Paste it into the Domain ID field when configuring the Secure Privacy tag in GTM. See how to install Secure Privacy via Google Tag Manager.
- API integrations — Include it as the domain_id parameter in API requests. See the Secure Privacy API overview[?] for full endpoint documentation.
- Custom script implementations — Reference it in any manual embed where the consent script requires a site or domain identifier.
- Support requests — Sharing your Domain ID with our support team helps us locate your exact domain configuration quickly.
Troubleshooting
I can't see a Domain ID in my settings
Make sure you have selected a specific domain before opening Settings — the Domain ID field only appears at the domain level, not on the top-level account overview. If you manage multiple sites, check that you've selected the correct one from the domain switcher.
I have multiple domains — which ID do I use?
Each domain has its own Domain ID. Use the ID that corresponds to the specific website you are configuring. If you're unsure which domain a script or integration should point to, match the Domain ID to the domain URL shown in the Websites list.
My integration says the Domain ID is invalid
Double-check that you copied the full value with no leading or trailing spaces. Some copy operations pick up an invisible whitespace character — pasting into a plain-text editor first and then re-copying can resolve this. If the problem persists, contact Secure Privacy support[?] with your Domain ID and a description of the integration you're configuring.
Frequently Asked Questions
Where do I find my Domain ID in Secure Privacy?
Log in to your Secure Privacy account, select the relevant domain, and navigate to Settings. Your Domain ID is displayed near the top of the Domain Settings page. Click the copy icon to copy it to your clipboard.
What is the Domain ID used for in Secure Privacy?
The Domain ID uniquely identifies a specific website within your Secure Privacy account. It is used in API calls, custom script embeds, third-party integrations (such as Google Tag Manager), and when contacting support so the team can locate your domain configuration.
Is the Domain ID the same as my account ID?
No. Your account ID identifies your Secure Privacy account as a whole, while the Domain ID is scoped to a specific website within that account. If you manage multiple domains, each one has its own unique Domain ID.
Can I have multiple Domain IDs on one account?
Yes. Every domain (website) you add to your Secure Privacy account receives its own Domain ID. You can view all your domains from the Websites section of the dashboard and find each domain's ID in its individual Settings page.
Do I need a Domain ID to install Secure Privacy on my website?
For most standard CMS installations (WordPress, Shopify, Wix, etc.), the Secure Privacy plugin or embed snippet handles domain identification automatically. The Domain ID is typically needed for manual script implementations, API integrations, and advanced configurations such as cross-domain consent sharing.
Related Articles
- Domain Settings Overview
- Installing Secure Privacy via Google Tag Manager
- Secure Privacy API Overview
- Setting Up Cross-Domain Consent Sharing
- How to Add a New Domain to Your Account
---
# How to Publish the GPC Well-Known File (/.well-known/gpc.json) for Full Global Privacy Control Compliance
URL: https://support.secureprivacy.ai/article/how-to-publish-the-gpc-well-known-file-well-knowngpcjson-for-full-global-privacy
Product: Consent Management
Category: Compliance & Regulations
Published: 2026-03-31T19:42:00+00:00
Updated: 2026-03-31T23:00:49.738+00:00
Reading Time: 8 minutes
Summary: Learn how to create and deploy the /.well-known/gpc.json file to pass all three GPC compliance indicators. Templates for WordPress, Nginx, Apache & Shopify.
Your cookie consent platform can detect and honor Global Privacy Control (GPC) signals automatically — but that alone is not enough to pass a full GPC compliance check. Tools like the GPC Inspector browser extension, automated privacy scanners, and regulatory audits evaluate three separate indicators: whether GPC is enabled in the visitor's browser, whether the server detects the signal, and whether the website itself formally declares that it supports GPC. That third indicator is entirely on the website owner's side, and it requires one specific action: publishing a machine-readable JSON declaration file at a fixed path on your domain.
Without this file, the "supported by website" indicator stays inactive — even if your cookie consent solution is correctly installed and blocking non-essential cookies in response to GPC signals exactly as it should. It is the digital equivalent of honoring an opt-out request without ever publishing your opt-out policy: the practice is right, but the declaration is missing.
The good news is that Secure Privacy handles the detection and enforcement side of GPC out of the box — no script changes, no custom logic, no ongoing maintenance. The only task remaining for you as the website owner is publishing this one small file. This article explains what it is, where it goes, and how to deploy it across the most common hosting environments.
Who Is This For?
- Website owners and developers who have installed Secure Privacy and want to achieve a fully passing GPC compliance check
- Privacy and compliance teams whose GPC Inspector or compliance scanner shows the third indicator ("supported by website") as inactive
- Technical teams responsible for deploying the /.well-known/gpc.json file across static, WordPress, Shopify, Nginx, or Apache hosting environments
What Is the GPC Well-Known File?
The GPC well-known file is a small, publicly accessible JSON document that a website publishes to formally declare that it recognizes and honors the Global Privacy Control signal. It is part of the GPC specification, which follows the IETF Well-Known URIs standard — a common pattern used across the web for machine-readable site-level declarations (the same pattern used by robots.txt, security.txt, and Apple Pay domain verification files).
The file must be served at a fixed, predictable path so that browsers, privacy extensions, and compliance scanners can find it without any prior knowledge of your site's structure, for example this file path would look like this for secureprivacy.ai - on your domain the path should be exactly the same (just replace secureprivacy.ai below with your base domain DNS name):
https://secureprivacy.ai/.well-known/gpc.jsonWhen the GPC Inspector extension or an automated scanner fetches this URL and receives a valid response, it marks your site as actively declaring GPC support — completing the third indicator in a full GPC compliance check.
What Secure Privacy Handles Automatically
Before covering the file itself, it is worth being clear about what Secure Privacy already does for you out of the box — so you know exactly how much (or how little) is left to do.
From the moment the Secure Privacy script is installed on your website and the Global Privacy Control toggle is enabled in your Browser Signals settings, Secure Privacy will:
- Detect the Sec-GPC: 1 HTTP header and navigator.globalPrivacyControl JavaScript property sent by GPC-enabled browsers
- Automatically restrict all cookies to essential-only for any visitor whose browser has GPC active — no banner interaction required on their part
- Log GPC-triggered consent interactions alongside standard banner interactions in your consent dashboard
- Display detected GPC and Do Not Track signal status to visitors through the configurable browser signals indicator on your consent banner
None of this requires you to write code or configure anything beyond the initial script installation. The /.well-known/gpc.json file is the one remaining step — a public declaration that your site's behavior already reflects.
The GPC Well-Known File: Template
Create a plain text file named gpc.json with the following content:
{
"gpc": true,
"lastUpdate": "YYYY-MM-DD"
}- "gpc": true — the required field. Declares that this website supports and will honor the Global Privacy Control signal. Setting this to false is a valid declaration that the site does not honor GPC — which is the opposite of what you want.
- "lastUpdate" — an ISO 8601 date in YYYY-MM-DD format recording when this declaration was last reviewed. Replace with today's date. Update it whenever your GPC policy or implementation changes. This field helps regulators and auditors assess how current your declaration is.
That is the complete file. No additional fields are required by the current GPC specification.
Where and How to Deploy the File
Again, the file must be reachable at exactly this path - /.well-known/gpc.json from your domain root — for example, for secureprivacy.ai it would be - https://secureprivacy.ai/.well-known/gpc.json. The exact deployment method depends on your hosting environment.
Required Serving Conditions (All Environments)
Regardless of how you deploy the file, it must meet the following conditions to be recognized by GPC Inspector and compliance scanners:
- Returns HTTP status 200 OK — not a redirect (301/302) and not a 404
- Served with Content-Type: application/json
- Accessible without authentication — the file is fetched as an unauthenticated GET request
- If your site operates across multiple subdomains that process personal data, each subdomain should host its own /.well-known/gpc.json file
Static Sites and File Hosting
Create a folder named .well-known at the root of your web server's public directory (e.g., /public_html/.well-known/ or /var/www/html/.well-known/) and place gpc.json inside it. Ensure both the folder and file are publicly readable. On most static hosting platforms (Netlify, Vercel, GitHub Pages), simply committing the file at /.well-known/gpc.json in your repository root is sufficient.
WordPress
Upload the file via FTP, SFTP, or your hosting file manager to /public_html/.well-known/gpc.json (or the equivalent public root for your hosting provider). Alternatively, use a plugin that manages /.well-known/ routes, or add a rewrite rule to your .htaccess to serve the file. Confirm the file is reachable by opening its URL directly in a browser tab before testing with the GPC Inspector.
Shopify and Other Hosted Platforms
Fully hosted platforms like Shopify restrict direct file system access, which means you cannot simply upload a file to a .well-known/ directory. Options include creating a URL redirect to an externally hosted copy of the JSON file, or using a custom app or middleware layer to serve the response at the required path. Check your platform's documentation for the recommended approach to hosting well-known URIs.
Nginx
Add a location block to your server configuration to serve the .well-known directory from your document root:
location /.well-known/ {
root /var/www/html;
default_type application/json;
}Reload Nginx after making the change: sudo nginx -s reload.
Apache
Place the file in your document root under .well-known/gpc.json. If your .htaccess configuration blocks access to dotfiles or dotfolders, add an explicit exception:
Require all granted
You can also force the correct Content-Type header for the file:
Header set Content-Type "application/json"
How to Verify the File Is Working
Once the file is deployed, verification takes under a minute:
- Paste your file URL directly into a browser tab — https://<>/.well-known/gpc.json — and confirm it returns the JSON content with no redirect and no error.
- Open your website with the Global Privacy Control Inspector extension active and GPC enabled in your browser. The third indicator — "supported by website" — should now display as active.
- Check the HTTP response headers using browser DevTools (Network tab) to confirm the response status is 200 and Content-Type is application/json.
If the third indicator remains inactive after deployment, the most common causes are: the file path is not exactly /.well-known/gpc.json, the server is returning a redirect instead of a direct 200, or the file is blocked by an authentication layer or .htaccess rule.
Frequently Asked Questions
Do I need the gpc.json file if Secure Privacy is already installed?
Yes. Secure Privacy handles GPC signal detection and cookie blocking automatically, but the gpc.json well-known file is a separate, website-owner responsibility defined by the GPC specification. Without it, your site will not pass the third indicator in a GPC compliance check — even if Secure Privacy is correctly installed and functioning. The file is a public declaration that complements the enforcement Secure Privacy already provides.
Is publishing the gpc.json file legally required under CCPA?
The California Privacy Protection Agency (CPPA) guidance and the GPC specification strongly recommend publishing the well-known file as part of a complete GPC implementation. While enforcement actions to date have focused on honoring the GPC signal rather than on file publication specifically, publishing the file is considered best practice and is required for your site to pass automated GPC compliance checks and third-party audits.
Does the gpc.json file need to be updated regularly?
The file itself only needs to change if your GPC policy changes. However, it is good practice to update the lastUpdate date whenever you review your privacy implementation — for example, after a platform update, a change in your cookie categories, or a regulatory update. This keeps your declaration current and demonstrates active compliance maintenance to auditors.
What happens if my site has multiple subdomains?
Each subdomain that independently processes personal data should host its own /.well-known/gpc.json file. The GPC specification does not allow a root domain declaration to cover subdomains automatically. If your subdomains share a common infrastructure, you can configure your web server to serve the same file content across all of them.
Can I test my gpc.json file without the GPC Inspector extension?
Yes. Open your browser's developer tools, navigate to the Network tab, and fetch the file URL directly — https://yourdomain.com/.well-known/gpc.json. Confirm the response status is 200, the Content-Type header is application/json, and the response body contains valid JSON with "gpc": true. This confirms the file is correctly deployed regardless of which GPC-aware tool you use to check it.
You Are Now Fully GPC-Compliant
With the /.well-known/gpc.json file published and Secure Privacy installed, your website meets the full requirements of a GPC-compliant implementation: browser signal detection, automatic cookie restriction for GPC-enabled visitors, and a public machine-readable declaration. All three GPC Inspector indicators should now show as active — giving you a defensible, auditable record of your site's compliance with CCPA/CPRA opt-out signal obligations.
Secure Privacy continues to handle the enforcement layer automatically as visitor behavior, browser GPC support, and regulatory expectations evolve — with no ongoing changes required on your end.
Need Help?
Contact Secure Privacy support at support@secureprivacy.ai if you have questions about deploying the GPC well-known file or verifying your GPC compliance setup.
See Also
- Global Privacy Control (GPC) & Do Not Track — Browser Signals & Cookie Banner Setup[?]
- Global Privacy Platform (GPP) Setup
- Basic vs. Advanced Google Consent Mode
- Implementing Meta Consent Mode with Secure Privacy
---
# Self-Service Privacy Rights Portal: Submit GDPR & CCPA Data Requests and Link from Your Cookie Banner
URL: https://support.secureprivacy.ai/article/self-service-privacy-rights-portal-submit-gdpr-ccpa-data-requests-and-link-from-
Product: Consent Management
Category: Policies & User Consent
Published: 2026-03-31T19:42:00+00:00
Updated: 2026-03-31T20:41:07.455+00:00
Reading Time: 11 minutes
Summary: Allow visitors to exercise GDPR & CCPA rights via Secure Privacy's Self-Service Privacy Rights Portal. Learn how to link it from your cookie banner or policy.
When a visitor wants to delete their data, access what you've collected, or opt out of data processing, where do they go? Most websites bury a compliance email address in the footer — if they provide anything at all. That forces data subjects through slow, manual back-and-forth, leaves organizations scrambling to meet GDPR's 30-day response deadline, and creates a paper trail that's nearly impossible to audit.
Generic web forms and standalone DSAR ticketing tools exist, but they require separate setup, sit outside your consent stack, and rarely cover the full breadth of rights mandated by GDPR, CCPA/CPRA, India DPDPA, and similar frameworks.
Secure Privacy's Self-Service Privacy Rights Portal solves this with a single, branded DSAR hub — hosted at dsar.secureprivacy.ai and automatically scoped to your organization — that covers every data subject right in one place. You can surface it to visitors with two clicks from your cookie banner or privacy policy, without touching a single line of code.
By the end of this guide, data subjects will know how to submit any privacy request through the portal, and organizations will know exactly how to link the portal from their cookie banner and policies inside Secure Privacy CMP.
Who Is This For?
This article serves two audiences:
- Individuals (data subjects) — website visitors who need to exercise a privacy right (delete, access, correct, opt out, appeal, etc.) with an organization that uses Secure Privacy.
- Organizations and website owners — businesses using Secure Privacy CMP who want to make the Self-Service Privacy Rights Portal accessible to visitors via the cookie banner or a privacy/cookie policy link.
Portal Overview
The Self-Service Privacy Rights Portal is an enterprise-ready, multi-language interface for submitting and managing personal data requests. Key features include:
- Language selection — visitors choose their preferred language before or during a session.
- Action-card layout — each request type is a first-class card so users find and start the right request immediately.
- Secure, auditable submissions — requests are tracked with full transparency for both the data subject and the organization.
- Broad regulatory coverage — supports GDPR, UK GDPR, CCPA/CPRA, India DPDPA, and similar frameworks, including statutory response timelines and appeal paths.
Available Privacy Request Types
The portal exposes every major data subject right as a dedicated action card:
- Delete My Information — invoke the right to erasure (GDPR Art. 17 / CCPA deletion right).
- Access My Information — request a copy of collected personal data (right of access).
- Correct My Information — request correction of inaccurate or incomplete data (GDPR Art. 16).
- Opt Out of Sale or Sharing of My Information — exercise CCPA/CPRA opt-out rights.
- Restrict Processing of My Information — limit how data is processed (GDPR Art. 18).
- Object to Processing of My Information — object to data processing (GDPR Art. 21).
- Agent / Authorized Representative Request — submit a request on behalf of another individual.
- Consent Record / Proof of Consent — obtain a record of consent given.
- Appeals — appeal a denied or partially fulfilled data request.
How to Submit a Privacy Rights Request (Data Subjects)
This section is for individuals submitting a GDPR, CCPA, or other privacy request to an organization. How you reach the portal depends on the organization — many sites link it from the cookie banner or their Privacy Policy / Cookie Policy. You may also receive a direct URL.
Prerequisites
- A link or direct URL to the organization's Self-Service Privacy Rights Portal (provided in the cookie banner, privacy policy, or directly by the organization).
- Any identity-verification information the organization requires (e.g. email address or account details) as described on the portal.
Step 1 — Open the Self-Service Privacy Rights Portal
Click the link in the organization's cookie banner or privacy policy, or open the direct URL provided to you. The portal loads at dsar.secureprivacy.ai with an encoded parameter that ties the session to the organization.
Step 2 — Select your preferred language
If a language selector is shown at the top of the portal, choose your preferred language before proceeding.
Step 3 — Choose the request type
From the grid of action cards, select the request type that matches your need — for example, Delete My Information (right to erasure), Access My Information (data subject access request), or Opt Out of Sale or Sharing (CCPA opt-out).
Step 4 — Complete and submit the request
Follow the on-screen prompts to provide the required details, then submit. Note the reference number or confirmation message shown — you will need it to track your request.
Step 5 — Appeal if needed
If your request is denied or only partially fulfilled, return to the portal and use the Appeals card to challenge the decision.
How to Link the Privacy Rights Portal on Your Website (Organizations)
The steps below assume your organization already uses Secure Privacy and the CMP script is installed on your website. Use Option 1 to surface the portal from the cookie banner, or Option 2 to add it to your Privacy Policy or Cookie Policy.
Option 1 — Link from the Cookie Banner (Templates → Cookie Banner → Edit)
Use this path to add a Self-Service Privacy Rights Portal link directly inside your cookie banner text — the highest-visibility placement for GDPR and CCPA compliance notices.
Step 1 — Open Templates and select your template
In the Secure Privacy CMP, click Templates in the top navigation, then click the template that applies to your domain (for example, India DPDPA (Copy)).
Step 2 — Open the Cookie banner section
In the left sidebar, click Cookie banner. At the top right of the cookie text area, click Edit.
Step 3 — Select text and open the Link to control
In the editor, highlight the word or phrase where you want to add the privacy rights portal link. Then open the Link to dropdown in the cookie banner text toolbar.
Step 4 — Choose "Link to external data request form"
Select Link to external data request form from the dropdown. This points the selected text at your Self-Service Privacy Rights Portal hosted on dsar.secureprivacy.ai. Other available link targets (preference center, privacy policy, cookie policy, in-product data request form) are for different destinations — use the external option for the DSAR portal.
Cookie banner editor — Link to dropdown with Link to external data request form selected (Self-Service Privacy Rights Portal).
In the example shown in this documentation, the word preferences in the sentence "Feel free to update your preferences anytime." was linked to the external data request form. Visitors who click that word are taken directly to the privacy rights portal. The linked text appears as a styled hyperlink in both the editor and the live banner.
Cookie banner text after linking — preferences now points to the Self-Service Privacy Rights Portal (external data request form).
Step 5 — Save the template
Click the green SAVE button at the top right of the template editor. Your cookie banner changes are not live on the website until you save. Click CANCEL only if you want to discard all unsaved changes.
Step 6 — Verify the template is assigned to your domain
Open Domains in the top navigation, select the domain where the CMP script is installed, and confirm that the active template for that domain is the same template you just edited. If your domain uses a different template, either reassign the domain to this template or repeat the cookie banner steps on the correct template.
Multiple regions: If you use multiple templates by region or regulation, repeat this verification for every template that should surface the Self-Service Privacy Rights Portal link.
What Visitors See After Clicking the Banner Link
When a visitor clicks the linked text in the cookie banner, the browser opens the Self-Service Privacy Rights Portal at dsar.secureprivacy.ai with an encoded data= parameter that scopes the session to your domain and return URL. Visitors do not need to type or know this URL — it is opened automatically.
The portal displays a language selector and a grid of privacy rights action cards: Delete My Information, Access My Information, Correct My Information, Opt Out of Data Processing, Restrict Data Processing, Object to Data Processing, Authorized Agent Request, Withdraw Consent, and Appeal a Decision.
Live Self-Service Privacy Rights Portal (dsar.secureprivacy.ai) opened from the cookie banner link — language selector and full grid of GDPR and CCPA data subject rights cards.
Option 2 — Link from Privacy Policy or Cookie Policy (Policies → Edit)
Use this path to add a Self-Service Privacy Rights Portal link inside your Privacy Policy or Cookie Policy text — useful for fulfilling the GDPR requirement to inform data subjects how to exercise their rights within policy documents.
Step 1 — Open Policies and select the relevant policy
In the Secure Privacy CMP, click Policies in the top navigation. Click the Privacy Policy or Cookie Policy that applies to the domain where you want the portal link to appear.
Step 2 — Click Edit and select your link text
Click Edit to open the policy editor. Highlight the word or phrase you want to hyperlink to the portal (for example, "submit a data request" or "exercise your rights").
Step 3 — Choose "Link to external data request form"
Open the Link to control in the toolbar and select Link to external data request form. The behavior is identical to the cookie banner editor: the selected text becomes a hyperlink to your Self-Service Privacy Rights Portal on dsar.secureprivacy.ai.
Step 4 — Save or publish the policy
Save or publish the policy per your Secure Privacy CMP workflow. The updated policy text and portal link will be live wherever that policy is displayed.
Visitors who follow the link from your policy see the same Self-Service Privacy Rights Portal experience as visitors who follow the cookie banner link — language selector and full request-type card grid on dsar.secureprivacy.ai.
Admin Configuration Notes
- Configure and publish the Self-Service Privacy Rights Portal for your domain(s) from the Secure Privacy CMP dashboard.
- Link the portal URL from both your privacy policy and your consent/preference center so data subjects can always find it, regardless of how they browse your site.
- Configure request types, identity verification, and response workflows to align with your privacy program and legal obligations under GDPR, CCPA/CPRA, India DPDPA, and other applicable laws.
- If you use geotargeted templates (different consent banners per region), verify the portal link is added to each active template — not just the default.
Troubleshooting
The portal link is not appearing in the live cookie banner
Confirm you clicked SAVE after editing. Then check Domains → [your domain] and verify the active template is the one you edited. If a different template is assigned, either switch the domain to the edited template or add the link to the correct template.
Visitors are landing on the wrong portal or seeing an error
Ensure you selected Link to external data request form — not "Link to data request form" (which points to the in-product form, not the hosted DSAR portal). If visitors still encounter an error, confirm the Self-Service Privacy Rights Portal is fully configured and published for your domain in the CMP dashboard.
The link is showing in the editor but not on the live website
Clear your browser cache and check whether a cookie caching layer or CDN is serving a stale version of the banner script. Allow up to a few minutes for changes to propagate after saving.
Frequently Asked Questions
What is a Self-Service Privacy Rights Portal?
A Self-Service Privacy Rights Portal is a secure, branded interface that lets individuals submit and track privacy requests — data access, deletion, correction, opt-out, and more — under GDPR, CCPA/CPRA, India DPDPA, and similar regulations. Secure Privacy hosts the portal at dsar.secureprivacy.ai, automatically scoped to your organization.
How do I submit a GDPR data subject access request (DSAR)?
Open the portal link in the organization's cookie banner or privacy policy. Choose Access My Information from the action-card grid, complete the form, and submit. Note the reference number provided for tracking.
How do I request deletion of my personal data?
Use the Delete My Information card in the portal. This invokes your right to erasure under GDPR Article 17. If the request is denied, use Appeals to challenge the decision.
How do I add a DSAR link to my cookie banner in Secure Privacy?
Go to Templates, open the template for your domain, click Cookie banner → Edit, highlight your chosen text, open the Link to dropdown, select Link to external data request form, and click SAVE. Then verify the template is assigned to your domain under Domains.
What privacy regulations does the Secure Privacy DSAR portal support?
The portal supports GDPR, UK GDPR, CCPA/CPRA, India DPDPA, and similar frameworks, covering the full range of data subject rights: access, deletion, correction, opt-out, restriction, objection, consent records, authorized agent requests, and appeals.
Can I link the privacy rights portal from my Privacy Policy instead of the cookie banner?
Yes. In the Secure Privacy CMP, go to Policies, open the relevant policy, click Edit, highlight your link text, select Link to external data request form, and save. Visitors who click that link see the same portal experience as those who follow the cookie banner link.
Related Articles
- Consent Dashboard: Viewing and Managing Cookie Consent Records
- Cookie Banner Customization: Templates, Text, and Design Settings[?]
- Domain Settings: Assigning Templates and Managing Active Configurations
- GDPR Data Subject Rights: What They Are and How Secure Privacy Handles Them
- CCPA/CPRA Opt-Out of Sale: Configuring the "Do Not Sell or Share" Link[?]
---
# Extra Consents Settings: Managing Cookie Consent Overage in Your Secure Privacy Plan
URL: https://support.secureprivacy.ai/article/extra-consents-settings-managing-cookie-consent-overage-in-your-secure-privacy-p
Product: Consent Management
Category: Policies & User Consent
Published: 2026-03-31T19:42:00+00:00
Updated: 2026-03-31T20:27:58.793+00:00
Reading Time: 10 minutes
Summary: Hit your cookie consent plan limit? Learn how to set an extra consents budget in Secure Privacy to extend recording capacity and control overage spend.
When your website hits its subscription consent limit, cookie consent records can quietly stop being stored in the cloud — leaving you with compliance gaps you may not notice until an audit or a visitor complaint surfaces the problem. Most teams discover this only after the fact, scrambling to figure out why recorded consent counts no longer match their traffic.
Generic workarounds — manually tracking consent in spreadsheets, switching to a cheaper tool with no overage option, or simply ignoring the cap — either create more work or introduce real regulatory risk under GDPR, CCPA, and ePrivacy rules. And while upgrading your entire subscription plan is always an option, it can mean paying for headroom you only occasionally need.
Secure Privacy's Extra Consents Settings give you a smarter middle path: a configurable overage budget that extends your consent recording capacity exactly when you need it, charged in transparent per-block increments, with a hard cap so you stay in control of spend. By the end of this guide you'll know exactly how to set your extra consents budget, what happens at each threshold, and how to avoid common billing surprises.
Who Is This For?
This article is intended for:
- Account administrators responsible for managing the Secure Privacy CMP subscription and billing settings.
- Billing contacts who need to authorize usage-based spend above the included plan consent volume.
- Compliance or operations teams who need to ensure uninterrupted consent recording during traffic spikes or campaign periods.
If you are on a Free or Trial account, the Extra Consents Settings section is not available — see Eligibility below.
Overview: How Extra Consent Billing Works
Your Secure Privacy subscription plan includes a fixed consent volume. Extra Consents Settings let you set a spending budget for consent recording above that plan limit. You are charged at the rate shown in the product — for example, $10.00 per 100,000 consents over the limit. The currency and pricing on screen always reflect your account billing currency (EUR or USD).
Key distinction: Your plan's included consent allowance and your extra consents budget are two separate controls. Upgrading your plan (under Account → Plans) increases your included allowance. Setting an extra consents budget (under Account → Billing) adds flexible, usage-based overage capacity on top. You can use one, both, or neither — depending on your traffic and contract.
Important Points Before You Configure
Included consents vs. extra budget
Your plan covers a set consent volume. Extra Consents Settings only govern how much additional usage you authorize beyond that — they do not replace choosing the right plan for your long-term traffic.
No automatic plan upgrade
Secure Privacy does not automatically move your account to a higher subscription tier when usage climbs. Overage is handled entirely through your extra consents budget, which you control in the dashboard.
Default is zero (off)
The extra consents budget defaults to zero, meaning no paid overage is authorized. Until you enter a non-zero value and click SAVE, the feature is effectively disabled for billing purposes — even on paid plans.
Budget must cover the next block
Once you set a non-zero budget, it must be large enough to cover at least one full block at the rate shown (e.g. $10.00). If it is too low for the next purchasable block, consent recording behavior remains the same as when extra consents are disabled.
Eligibility
Extra Consents Settings are not available on Free or Trial accounts. If the section is absent from your Billing page, your account type may not include it. Upgrade or subscribe as required by your contract.
Monthly vs. yearly subscriptions
On monthly plans, extra consent usage is reflected in line with your Billing page. On yearly plans, overages may be billed on a separate schedule and may not appear on the main Billing summary — check your full invoice list and use date filters in the CMP for the complete picture.
Email notification at first activation
You may receive an email the first time extra consent usage is activated in a billing month, so your billing and operations teams are aware that usage-based charges have begun for that period.
Lowering the budget after activation
If extra consent usage has already been activated for a billing period, setting the budget back to zero does not instantly cancel an already-started block. You may still be invoiced for usage that was already committed. For exact impact, review your invoices and contact support or your account manager.
Where to Find Extra Consents Settings
- Sign in to the Secure Privacy CMP at cmp.secureprivacy.ai.
- Open Account from the main navigation.
- Select Billing.
- Scroll to the section titled EXTRA CONSENTS SETTINGS.
What You See on Screen
The Extra Consents Settings panel in Secure Privacy Billing — set your overage budget and click SAVE to authorize additional consent recording beyond your plan limit.
Element
Purpose
Section title
EXTRA CONSENTS SETTINGS
Description line
Explains the extra budget concept and shows the price per unit (e.g. $10.00 per 100,000 consents). Use the information (i) icon for in-product help.
Amount field
Numeric field prefixed with your billing currency symbol. Enter the maximum budget you want to authorize for extra consents (0 = no paid overage).
SAVE
Saves your extra consents budget. Always click this after any change.
Currency (EUR / USD)
The currency symbol and pricing shown depend on your account's billing currency. Accounts billed in euro see EUR (€) rates; accounts billed in US dollar see USD ($) rates. Always rely on what appears on your Billing page — not screenshots from another account.
What Happens When Your Cookie Consent Plan Limit Is Reached
Behavior at the plan limit depends on whether extra consents are enabled and whether your budget covers the next chargeable block.
Extra consents disabled (budget is zero or unsaved)
If you have not set a non-zero extra consents budget:
- Visitors may still see the cookie consent banner where your implementation shows it, but consent records may not be stored in your Secure Privacy account — they can be held locally in the browser for basic compliance display only.
- When your billing period resets the consent counter on Secure Privacy's side, normal cloud recording resumes up to your plan limit.
If full cloud recording must continue after the limit is hit, raise your plan and/or set an appropriate extra consents budget and save it.
Extra consents enabled but budget too low for the next block
If you entered a non-zero budget but it is insufficient to purchase the next block at the listed price, cloud recording does not switch on for that extra tier. Increase the budget to cover at least one full block at the rate shown, then click SAVE.
After Extra Consents Have Been Activated
Once usage-based extra consent recording has activated for your subscription:
- Setting the budget to zero later does not always mean immediate stop — you may still be invoiced for an already-committed block, and consent recording may continue until that package is used up.
- For the exact effect on your account, review Billing, your invoices, and your order form, or contact support or your account manager.
How to Set or Change Your Extra Consents Budget
Follow these steps to configure the extra consents overage budget in your Secure Privacy account.
Step 1 — Open Account Billing
Sign in to cmp.secureprivacy.ai, then navigate to Account → Billing.
Step 2 — Locate Extra Consents Settings
Scroll down the Billing page to the section titled EXTRA CONSENTS SETTINGS.
Step 3 — Confirm your overage rate
Read the on-screen description to confirm the rate per block (e.g. $10.00 per 100,000 consents) and the currency that applies to your account.
Step 4 — Enter your budget
Type your desired maximum overage budget in the amount field. The currency prefix is read-only — edit the number only. Enter 0 to disable paid overage.
Step 5 — Save your changes
Click SAVE. Confirm no error messages appear. If applicable, verify that billing or usage reports reflect the updated budget after processing.
Prerequisites and Permissions
- You need Account and Billing access in the CMP — typically an admin or billing role, depending on your organization's user configuration.
- Extra Consents Settings require a paid subscription. The section is not visible for Free or Trial accounts.
- Your subscription and payment method must be in a state that allows billing changes. If SAVE is disabled or errors appear, see Troubleshooting below.
Troubleshooting Extra Consents Settings
Issue
What to try
SAVE does nothing or stays disabled
Refresh the page, confirm you entered a valid number, and verify you have permission to edit billing settings.
Wrong currency on screen
Currency follows your account billing profile. Verify you are in the correct Secure Privacy account and that the billing contract matches your region.
Need to remove extra consents spend
Set the budget to 0 (or the minimum allowed) and click SAVE, unless your contract requires changes through your account manager.
Section missing on Billing page
Confirm you are not on a Free or Trial account — the section is hidden for those. Otherwise, refresh, check you are in the correct account, or contact support.
At plan limit and consents not appearing in the CMP
If extra consents are disabled (budget 0), cloud recording may stop until the period resets or you enable a sufficient budget — see What Happens When Your Cookie Consent Plan Limit Is Reached.
Budget is non-zero but nothing improved
The amount may be below the minimum needed for the next extra block at the listed price. Increase the budget and click SAVE.
Yearly plan and line items look different
Extra overage may appear on separate invoices. Widen the invoice date filters in the CMP to see the full picture.
Rate or limits unclear
Use the information (i) icon next to the description, or contact support/your account manager with your account name and a screenshot of the Extra Consents Settings block (redact sensitive data as needed).
Frequently Asked Questions
What happens when I reach my cookie consent plan limit?
When your included consent volume is exhausted and no extra consents budget is set, consent records may stop being stored in your Secure Privacy account. Visitors can still see the cookie banner, but recordings are held locally in the browser only. To resume full cloud recording, either upgrade your plan or set a non-zero extra consents budget in Account → Billing.
How does Secure Privacy charge for consent overage?
Secure Privacy charges for extra consents in blocks — for example, $10.00 per 100,000 consents. The rate and currency shown in the Extra Consents Settings section reflect your account's billing currency. You authorize a maximum budget cap; charges only apply once your included plan consents are used up.
Will Secure Privacy automatically upgrade my plan when I exceed my consent limit?
No. Secure Privacy does not automatically move your account to a higher subscription tier. You remain in control through the Extra Consents Settings budget. If your traffic consistently exceeds your plan limit, you can manually upgrade your plan under Account → Plans or set an appropriate extra consents budget.
Can I set a cap on how much I spend on extra consents?
Yes. The Extra Consents Settings section lets you enter a specific budget amount. Secure Privacy will not charge beyond that cap for extra consents in a billing period. Set it to zero if you do not want any paid overage.
What is the difference between upgrading my plan and setting an extra consents budget?
Upgrading your subscription plan (Account → Plans) permanently increases your included consent allowance. Setting an extra consents budget (Account → Billing) adds a flexible, usage-based overage allowance on top of your current plan. You can use one, the other, or both depending on your traffic and contract.
Why is the Extra Consents Settings section not showing on my Billing page?
This section is hidden for Free and Trial accounts. It only appears for paid subscriptions. If you are on a paid plan and still cannot see it, try refreshing the page, confirm you are in the correct account, or contact Secure Privacy support.
Related Articles
- Understanding Secure Privacy Subscription Plans[?]
- Reading Your Secure Privacy Billing Invoices[?]
- Using the Secure Privacy Consent Dashboard
- Account and User Management in Secure Privacy
---
# Complete Guide to Blocking Cookies for GDPR Compliance: Prior Consent, Script Load Order & GTM Setup
URL: https://support.secureprivacy.ai/article/complete-guide-to-blocking-cookies-for-gdpr-compliance-prior-consent-script-load
Product: Consent Management
Category: Compliance & Regulations
Published: 2026-03-26T23:55:00+00:00
Updated: 2026-04-22T07:07:59.454+00:00
Reading Time: 28 minutes
Summary: Learn how to block cookies before consent under GDPR. Covers Secure Privacy auto-blocking, script load order, GTM consent triggers, and Google Consent Mode v2 setup.
If you've ever opened your browser's DevTools on a website — even one with a cookie consent banner — and watched analytics and advertising cookies land before you clicked anything, you've witnessed one of the most widespread GDPR violations on the web today. Non-essential cookies, from Google Analytics to the Facebook Pixel to LinkedIn's Insight Tag, are routinely set the moment a page loads, long before the consent banner has finished rendering — let alone before a visitor has responded to it. That's not a grey area: it's a direct violation of the ePrivacy Directive and GDPR Article 6, and it's one of the most frequently cited findings in enforcement actions by data protection authorities across the EU.
The instinct is to reach for a simple solution — a free cookie plugin, a manually coded delay, a "just add a banner" approach. These typically fail in one of three ways: they display a notice while tracking runs freely underneath, they block nothing but show a compliant-looking UI, or they break when a caching plugin reorders scripts and silently removes the consent gate. Getting genuine prior-consent cookie blocking right requires understanding four interlocking technical layers: automatic script interception, script load order, Google Tag Manager consent configuration, and Google Consent Mode v2 — each of which can independently undermine compliance if misconfigured.
This guide covers all four layers as implemented through Secure Privacy, a consent management platform built specifically for GDPR and ePrivacy compliance. By the end, you'll understand exactly how Secure Privacy intercepts non-essential scripts before they execute, why script load order is the single most overlooked compliance detail, how to configure Google Tag Manager so every tag respects consent status, how to implement and verify Google Consent Mode v2 for EU/EEA visitors, and how to maintain compliance as your site evolves.
Who Is This Guide For?
This guide is written for:
- Website owners and marketing teams who need to achieve GDPR cookie compliance and understand why a banner alone is not enough
- Developers and technical leads responsible for implementing or auditing a consent management platform, configuring GTM, or diagnosing pre-consent cookie firing
- DPOs and compliance managers who need a technical reference to evaluate whether an existing CMP implementation is genuinely blocking non-essential cookies before consent
- Anyone already using Secure Privacy who wants to understand how the blocking engine works, how to resolve gaps found in scan reports, and how to configure Google Consent Mode v2
If you are evaluating consent management platforms and want to understand what full technical compliance actually requires, this guide covers the complete picture — not just banner display, but script interception, load order, and platform-level consent signals.
Contents
- Why Prior Consent Is Non-Negotiable Under GDPR
- How Secure Privacy Automatic Blocking Works — and Its Limits
- Identifying & Manually Blocking Undetected Cookies
- Script Load Order: The Most Overlooked GDPR Compliance Detail
- Blocking Iframes, Pixels & Embedded Content
- GTM Installation: Consent-First Configuration
- Google Consent Mode v2 for EU/EEA Visitors
- Ongoing GDPR Cookie Audits & Maintenance
- Additional Compliance Considerations
- Frequently Asked Questions
- Quick Reference: All Related Guides
1. Why Prior Consent Is Non-Negotiable Under GDPR
GDPR Recitals 30 and 32, Article 6, and ePrivacy Directive Recital 25 are collectively unambiguous: any cookie or tracking technology that is not strictly necessary for a service explicitly requested by the user requires prior, freely given, specific, informed, and unambiguous consent before it may be set on a visitor's device.
"Strictly necessary" is a narrow category. It covers session authentication, shopping cart persistence, security tokens, and load-balancer cookies. It does not cover:
Cookies That Require Prior Consent Under GDPR
Cookie
Service
Category
Prior consent required?
_ga, _gid
Google Analytics
Analytics
Yes
_fbp, fr
Facebook / Meta Pixel
Advertising
Yes
IDE, NID
Google Ads / DoubleClick
Advertising
Yes
VISITOR_INFO1_LIVE
YouTube
Analytics
Yes
LinkedIn Insight Tag cookies
LinkedIn
Advertising
Yes
A consent banner that warns visitors while the scripts still run in the background is not compliant. The cookie must not be set until consent is recorded. This is not a technicality regulators overlook — pre-consent cookie loading is one of the most frequently cited findings in DPA enforcement actions across Germany, France, Italy, and Ireland.
Deep dive: Cookies Loading Before Consent? How to Fix Pre-Consent Cookie Loading and Achieve GDPR Compliance — covers how to identify non-compliant services in your scan report, step-by-step remediation, and a GDPR compliance checklist.
2. How Secure Privacy Automatic Blocking Works — and Its Limits
Secure Privacy generates a unique JavaScript blocking file for each domain based on its scan results. This file uses the MutationObserver API (compatible with all major browsers including IE11) to intercept scripts, pixels, and dynamically injected iframes in real time, holding them until the visitor grants the appropriate consent category.
The three blocking modes
Mode
Behaviour
Use when
v2 Blocking (current, recommended)
Intercepts all non-essential scripts, pixels, and dynamically injected iframes before they execute. Releases them as soon as the matching consent signal is received.
All new and existing installations — this is the default.
v1 Blocking (legacy)
Older interception mechanism. Less robust; maintained for backward compatibility only.
Existing v1 sites that have not yet migrated. Plan migration to v2.
Disabled
No automatic blocking. All scripts load freely unless you have manually gated every one.
Only for fully manual configurations — not recommended for general use.
Critical limitation: the scan boundary
Auto-blocking covers both the most recent scan detected and categorised and previously detected cookies via so called "aggregated scan" report". Any script, pixel, or tag added to your site after the last scan, or using a non-standard implementation that the crawler did not recognise, will not be blocked automatically. This is the single most common source of ongoing GDPR violations on sites that believe they are compliant.
Rule of thumb: Trigger a new scan every time a third-party script, marketing pixel, or analytics integration is added or updated — and at minimum once per quarter. Make sure these services and cookies ARE present in the scan report, correctly categorized and configured with a proper pixel/script/iframe source.
Deep dive: Automatic Cookie Blocking Explained – How Secure Privacy Blocks Scripts, Pixels, and Iframes — covers the MutationObserver mechanism, all three blocking modes, prerequisites, and how to manually extend the blocking configuration. Note: this article is from the legacy CMP v1 documentation. The step-by-step logic and concepts remain fully applicable to the current platform; however, the dashboard screenshots shown reflect the older interface.
3. Identifying & Manually Blocking Undetected Cookies
When automatic blocking has gaps, your scan report will show them inside "Prior consent to other than strictly necessary cookies" section inside the scan report.
Resolving this "usually" requires four steps:
Step 1 — Open the Scan Report
In your Secure Privacy dashboard, select the domain to work with, click the "Scan report" scroll down to the Prior consent to other than strictly necessary cookies (GDPR) → Cookies loaded before prior consent section. Note the cookie name and related service for each flagged item in the list.
Step 2 — Identify the source
Work with your development team to find the script URL, pixel endpoint, or iframe source responsible for the unblocked cookie. Browser DevTools (Network tab, filtered by the cookie name) will surface the originating request. Alternatively, directly searching the source code of the page (Ctrl+U or Command+U) could also help here.
Step 3 — Add the source to Service
In the dashboard, navigate to Classification → Services. Locate the service that is associated with the cookie in question - click the "three-dot" menu -> Edit. Check the entry, make sure to adjust/specify:
- Service name
- Category
- Instalaltion scripts got to: Script field, while Iframe, or Pixel sources also matches (if any)
- Privacy policy link (if avilable)
The script source URL must be best possbile match/pattern to cover different URLs and yes, partial URLs will work and usually are more useful, when used as a bare base domain name.
For example, instead of this full URL -
https://pagead2.googlesyndication.com/ccm/collect?frm=0&en=page_view&dl=https%3A%2F%2%2F&scrsrc=www.googletagmanager.com&rnd=39847927.1774647075&navt=n&npa=1&did=&gdid&_tu=CA>m=&gcs=G100&gcd=13p3p3p2p5l1&dma_cps=-&dma=1&tag_exp=0~115938465~115938468~116133312~117484252&apve=1&apvf=f&apvc=0&tids=AW-123123123123&tid=AW-123123123123&tft=1774647075154&tfd=123123you would want to simply add
googlesyndication.comStep 4 — Rescan to verify
Run a new scan from the Scan Report page. Confirm that the previously flagged service now shows as blocked.
Deep dive: How to Manually Block Cookies Not Blocked Automatically in Secure Privacy — full walkthrough of the Tag Blocking configuration screen, common causes of auto-blocking gaps, and troubleshooting exact-match URL issues.
Note 1: all 4 required steps are covered above.
Note 2: the link is a legacy CMP v1 documentation — steps still apply; screenshots reflect the older interface.
4. Script Load Order: The Most Overlooked GDPR Compliance Detail
Even a perfectly configured Secure Privacy CMP will fail to block cookies if it loads after the scripts it is supposed to intercept. Script load order is the most frequently overlooked compliance detail, and it is the root cause of many "but I installed the CMP!" GDPR violations.
Understanding async vs defer
Attribute
Download
Execution timing
Execution order
Good for compliance?
none (synchronous)
Blocks HTML parsing
Immediately, inline
Guaranteed DOM order
Yes — recommended,
but blocks rendering
defer
Parallel (non-blocking)
After HTML is fully parsed
Guaranteed DOM order
Yes — recommended, non-blocking if the execution order is correct
async
Parallel (non-blocking)
As soon as the file is downloaded — could be mid-parse
Not guaranteed — race condition
No !!! — compliance risk here !!! even if it "works in my browser"
async offers a performance benefit, but at a compliance cost: whichever script downloads fastest executes first. If Google Analytics or Facebook Pixel loads faster than Secure Privacy on that page request, the tracker fires before the CMP has initialised. Never use async on the Secure Privacy script.
defer is the correct choice. Deferred scripts download in parallel (fast, no render-blocking) but execute in DOM order after HTML parsing completes. Therefore, this would only if Secure Privacy is the first deferred script in , so that it will always execute before any other deferred (but, again, not "asynced") script.
Non-GTM installation: placement rules
For sites that embed the Secure Privacy script directly (not via GTM), follow these rules precisely:
Rule 1 — Place Secure Privacy first in
Position the Secure Privacy script in as high as possible — ideally immediately after the opening tag and any / tags. It must appear before any other third-party script tag.
Rule 2 — Use defer on the Secure Privacy script, not async
The async attribute creates a race condition that can allow tracking scripts to fire before the CMP initialises. Always use defer. (again, make sure Secure Privacy is the first in the )
Rule 3 — All other third-party scripts must also use defer
Because deferred scripts execute in DOM order, any script placed after Secure Privacy in the source will execute after it — preserving the consent gate. Do not allow any third-party script to use async.
Rule 4 — Synchronous legacy scripts must appear below Secure Privacy in source order
If a third-party script absolutely cannot use defer, it must still be placed below the Secure Privacy script in the source, so that Secure Privacy's synchronous initialisation completes first.
Correct example:
Incorrect example (compliance risk):
CMS script optimisation plugins — a hidden compliance trap
Many popular CMS caching and performance plugins include a feature that consolidates, minifies, or defers all scripts on a page automatically. This process frequently breaks the load order that compliance depends on by:
- Reordering scripts into a single concatenated bundle (Secure Privacy may end up in the middle or at the end)
- Changing defer attributes to async across all scripts
- Moving scripts to the footer
A pretty bright example here — WP Rocket (WordPress) — disable script optimisation for the Secure Privacy script !!!. As WP Rocket's "Delay JavaScript Execution" and "Load JavaScript Deferred" features can silently reorder or re-attribute the Secure Privacy initialisation script, breaking prior-consent blocking for every visitor. In WP Rocket settings, add the Secure Privacy script URL to the Excluded files list under File Optimization. The same applies to Autoptimize, LiteSpeed Cache's JS optimisation, and any other plugin that touches script attributes or order.
After installing or updating any caching or performance plugin, make sure (1) to reset / rebuild cache of these plugins and (2) always re-run our compliance "website scan" to verify that none of the non-essential cookies appear in the "loaded before prior consent" section of the report.
5. Blocking Iframes, Pixels & Embedded Content
Scripts are only part of the tracking surface. Iframes (video embeds, social widgets, map embeds) and tracking pixels also set cookies and must be blocked until the correct consent category is granted.
Every pixel and iframe must be associated with a service
Secure Privacy's blocking engine operates on a service-to-category mapping. For a pixel or iframe to be held behind consent, it must be:
Step 1 — Attach a service to iframe / pixel under Classification
Every pixel and iframe source must appear in your Secure Privacy dashboard under Classification → Pixels or Classification → Iframes with a correct Service entity attached.
Note: If a pixel or iframe was not auto-detected during the scan, create a service entry manually.
Step 2 — Confirm a Service is connected to a consent category
Each Service must be assigned a consent category (Analytics, Advertising, Social Media, Customer Interaction) — none of the Services may be left uncategorised. Services without a category will not be gated by the consent banner.
Step 3 — Link the source URL or domain
The Service must be linked to its source URL or domain so the blocking engine can match and intercept it at load time. See example above, under "Step 3 — Add the source to Tag Blocking".
Manual blocking: sp-consent and data-src
Sometimes, for iframes embedded directly in page HTML (as opposed to being injected by a script), auto-blocking may not apply due to the wat iframe is added to the DOM / . Therefore, you must modify the HTML attributes directly:
Step 1 — Add the sp-consent attribute
Add sp-consent="SERVICE NAME" to the iframe tag. The service name must exactly match the name shown in your Secure Privacy Scan Report — including capitalisation and spacing. Copy it directly from the dashboard rather than typing it manually, make sure no spaces before after the name (in both parts 😅).
Step 2 — Rename src to data-src
Rename the src attribute to data-src. This prevents the browser from loading the iframe until Secure Privacy releases it after consent is received.
Before:
After (GDPR-compliant):
(Optional) the same transformation may be applied to tracking pixels (image tags):
The youtube-nocookie.com trap. Using www.youtube-nocookie.com as the embed domain does not eliminate the consent requirement. While this domain avoids HTTP cookies, it stores persistent tracking data in the browser's HTML5 localStorage — which constitutes tracking under the ePrivacy Directive and requires prior consent in the same way. Apply the data-src + sp-consent transformation regardless of which YouTube embed domain is used.
Deep dive: How to Set Up Manual Script and iframe Blocking in Secure Privacy — full instructions for script type rewriting, iframe attribute modification, and the YouTube/Vimeo blocking pattern.
Note 1: all the required steps are provided above.
Note 2: the Deep dive" links to the legacy CMP v1 documentation — the implementation logic and attribute syntax are unchanged in the current platform; dashboard screenshots reflect the older interface.
6. GTM Installation: Consent-First Configuration
Google Tag Manager introduces additional compliance complexity because it manages multiple tags that may fire independently of each other. The following three configuration requirements are all mandatory — omitting any one of them creates a compliance gap. A bit more is covered here - How to Block Cookies in GTM Triggers Using User Consent Conditions.
6.1 Consent Initialization trigger — for Secure Privacy only
When Secure Privacy is deployed through GTM, it must use the "Consent Initialization — All Pages" trigger. This is a special GTM system trigger developed to be used only for Consent Management Platforms (like Secure Privacy) that fires before all other triggers on the page — it is the earliest possible execution point within the GTM lifecycle. Can't stress enough - no other tag should use this trigger.
Step 1 — Create a new tag using the Secure Privacy CMP template
In GTM, go to Tags → New. Under Tag Configuration, open the Community Template Gallery and search for Secure Privacy CMP. Select the template and enter your Secure Privacy Domain ID (found in the dashboard under Installation).
in the code snippet above 123123123123123123123 would be your Domain ID.
Step 2 — Assign the Consent Initialization trigger
Under Triggering, select Consent Initialization — All Pages. Save and publish.
If you previously installed the Secure Privacy script directly in your site's , remove it before activating the GTM template. Running both simultaneously causes a double-initialisation conflict and unpredictable consent behaviour (!!!).
6.2 Consent-based triggers for all non-essential services
Every tag (read my lips - each and every) that sets a non-essential cookie — analytics, advertising, personalisation — must be configured to fire only after the user has consented to the relevant category. GTM provides two patterns for this. Use the one that fits your trigger architecture.
Pattern A — Custom JavaScript variable (recommended for complex trigger logic)
Create a User-Defined Variable of type Custom JavaScript. This variable returns true if the visitor has consented to a specific service, or false otherwise. Add it as a condition to any trigger that should be consent-gated.
// Variable name: "Check Google Analytics consent"
function() {
return sp.checkConsent("Google Analytics");
}Then, in the trigger that fires your Google Analytics tag, add a condition:
Check Google Analytics consent | equals | trueThe service name passed to sp.checkConsent() is case-sensitive and must exactly match the service name in your Secure Privacy Classification tab. Copy it directly from the dashboard. A mismatch causes the function to always return false, silently blocking the tag regardless of consent status.
Create one variable per service. Repeat for every non-essential tag in your container.
Deep dive: How to Block Cookies in GTM Triggers Using User Consent Conditions — step-by-step setup with GTM Preview Mode verification instructions.
Pattern B — sp-consent custom event trigger (recommended for simpler setups)
Secure Privacy pushes a custom event to the GTM dataLayer when a visitor grants consent for a service. You can listen for this event as a GTM Custom Event trigger and use it to fire the corresponding tag.
Step 1 — Create a Custom Event trigger in GTM
In GTM, go to Triggers → New → Custom Event. In the Event Name field, enter: sp-consent="Google Analytics" — replacing the service name with the exact name from your Classification tab.
Step 2 — Name and attach the trigger
Name the trigger descriptively — for example: SP-Consent-Google-Analytics. Attach it to the Google Analytics tag. The tag will fire when Secure Privacy signals consent. Repeat for each additional service, creating one trigger per service.
Deep dive: How to Block Cookies in Google Tag Manager Using Secure Privacy Consent Event Triggers — full walkthrough of the custom event trigger pattern, including the multi-trigger edge case.
Multiple triggers on one tag? If a tag uses more than one trigger (e.g. it fires on Page View AND on a custom event), additional configuration is required to ensure consent gates apply to all firing paths. See the linked article for details.
7. Google Consent Mode v2 for EU/EEA Visitors
If you run Google Ads, Google Analytics, or any other Google advertising product and serve EEA visitors, Google Consent Mode v2 (GCM v2) is mandatory as of March 2024 under Google's EU User Consent Policy. It is not a replacement for a CMP — it is an additional signal layer that tells Google tags how to behave based on the consent your CMP collects. Full comparison article is here - Google Consent Mode: Basic vs Advanced — Complete Guide for GDPR & CCPA Compliance
Basic Mode vs Advanced Mode
Basic Mode
Advanced Mode
Tags before consent
Completely blocked — no data sent to Google
Tags fire but send only anonymous, cookieless pings
Conversion modelling
Limited
Enhanced — Google can model unobserved conversions
Data gaps
Significant before consent
Minimal — cookieless pings partially fill the gap
GDPR risk
Lower (nothing fires pre-consent)
Acceptable if cookieless pings do not constitute personal data processing
Recommended for
Strict DPAs (Germany, France) or very conservative legal advice
Most EU/EEA use cases
The seven GCM v2 consent parameters
Parameter
Controls
New in v2?
EEA default (best practice)
ad_storage
Advertising cookies
No
denied
analytics_storage
Analytics cookies
No
denied
functionality_storage
Functional cookies (not used often)
No
denied (non-essential)
personalization_storage
Personalisation cookies (not used often)
No
denied
security_storage
Security cookies (not used often)
No
granted (essential)
ad_user_data
Sending user data for advertising
Yes
denied
ad_personalization
Personalised advertising
Yes
denied
Secure Privacy automatically maps its consent categories to all seven GCM v2 parameters — no manual mapping is needed.
Configuring default consent states by region
GCM v2 supports per-region default states using ISO 3166-2 country codes (e.g. DE for Germany, FR for France, US-CA for California). This allows you to set stricter defaults for EEA visitors while using different defaults elsewhere.
In the Secure Privacy GTM template, add a setting for each region under Default Consent Settings:
Region: DE → ad_storage: denied | analytics_storage: denied | ad_user_data: denied | ad_personalization: denied
Region: FR → ad_storage: denied | analytics_storage: denied | ad_user_data: denied | ad_personalization: denied
Region: all → ad_storage: denied | analytics_storage: denied | ad_user_data: denied | ad_personalization: deniedApproach by DPA strictness level
Not all EU regulators apply the same standard. Adjust your GCM v2 configuration to match the strictness of the DPA(s) most likely to investigate your processing:
Standard EU/EEA (most countries)
Use Advanced Mode. Set all non-essential parameters to denied by default. Google tags fire pre-consent but send only cookieless aggregate pings — no personal identifiers stored. Consent updates are passed to Google when the visitor interacts with the banner.
Strict DPAs — Germany (BfDI / state DPAs), France (CNIL), Netherlands (AP)
These authorities have historically taken the most aggressive stance on analytics consent requirements and, in some decisions, have questioned whether even cookieless pings constitute personal data processing. For these jurisdictions, consider:
- Basic Mode: Google tags do not fire at all until consent is granted. Eliminates any pre-consent data transfer to Google entirely. Significant analytics data loss until the visitor accepts.
- Alternatively, in Advanced Mode, configure analytics_storage and ad_storage with "Additional Consent Required" signalling and apply regional overrides scoped to DE and FR so that tags are fully suppressed in those markets only.
Consulting your DPO or legal counsel for a final determination is a must!! — the right choice depends on your advertising spend, risk appetite, and whether you have a local establishment in those jurisdictions.
How to verify GCM v2 is working
After deployment, verify the consent signal using browser DevTools:
Step 1 — Check the pre-consent gcs parameter
Open DevTools, go to the Network tab, and filter by collect. Clear all cookies and reload the page without interacting with the banner. Inspect the outbound collect request — the gcs parameter should show G100 (all denied).
Step 2 — Confirm the post-consent update
Accept the banner and confirm gcs updates to G101 (analytics granted) or G111 (all granted).
You can also inspect the dataLayer in the browser console:
window.parent.dataLayerLook for consent events to confirm default states were set at initialisation and that updates are recorded after visitor interaction.
8. Ongoing GDPR Cookie Audits & Maintenance
A cookie compliance configuration is not a one-time task. Marketing teams add pixels, developers integrate new analytics tools, and CMS plugins update themselves — all without triggering a compliance review. The following cadence is the minimum required to maintain defensible GDPR compliance:
- After every third-party script, pixel, or integration change — trigger a fresh scan immediately and verify blocking status before releasing to production
- After any CMS, plugin, or theme update — re-verify that script load order has not been altered, especially if caching or performance plugins were involved
- Quarterly — full scan even if no changes are known; shadow IT additions are common
- After GTM container changes — verify all new tags are attached to consent-based triggers, not the generic All Pages trigger
For a complete ongoing compliance checklist, see Ongoing Checkups & Best Practices for Compliance.
9. Additional Compliance Considerations
The preceding sections cover the core cookie-blocking workflow. The following areas sit outside that workflow but are equally capable of creating GDPR exposure. Each deserves a deliberate decision, not a default.
9.1 Meta Consent Mode & Microsoft Consent Mode
Google Consent Mode is not the only platform-level consent API that requires explicit configuration. Both Meta (Facebook/Instagram) and Microsoft (Bing Ads, Microsoft Advertising, Clarity) have introduced their own consent mode mechanisms that govern how their tags and pixels behave in the absence of user consent. If you run advertising or analytics on either platform, enabling the corresponding consent mode is a separate requirement — configuring Google Consent Mode alone does not cover Meta or Microsoft signals.
Without Meta Consent Mode enabled, the Meta Pixel and Conversions API continue to send data to Meta regardless of the consent state recorded by your CMP. Without Microsoft UET Consent Mode, the Universal Event Tracking tag defaults to active tracking even when a visitor has declined advertising cookies. Microsoft now requires explicit consent from EU/EEA users before using first- and third-party cookies for advertising — making UET Consent Mode mandatory, not optional, for advertisers serving those markets.
Secure Privacy enables both modes from the dashboard, without custom code.
- Meta Consent Mode: How It Works & How to Enable It with Secure Privacy — covers Meta Pixel and Conversions API consent integration, regional configuration, and verification steps.
- How to Enable Microsoft UET Consent Mode with Secure Privacy — covers Microsoft Advertising UET tag consent integration; defaults ad_storage to denied for EU/GDPR regions automatically.
- How to Set Up Microsoft Clarity Consent Mode with Secure Privacy — covers Microsoft Clarity's separate consent commands; recommends the stop default state for EU/EEA regions.
9.2 IAB Transparency & Consent Framework (TCF 2.2)
If your website uses programmatic advertising — ad exchanges, SSPs, or DSPs that rely on standardised consent signals to decide whether to serve personalised ads — your CMP may need to support the IAB Transparency & Consent Framework (TCF). TCF defines a structured consent string format that is passed between your CMP, publishers, and the ad tech ecosystem so that every participant in the ad-serving chain can act on the visitor's consent choices.
TCF is not required for direct-tag setups (e.g. a single Google Ads tag managed in GTM) — it is relevant when you have a header bidding stack, an ad server, or third-party demand partners that read IAB consent strings. Be aware that several DPAs, including the Belgian DPA, have found specific aspects of TCF's implementation to be in breach of GDPR. If you operate under TCF, monitor DPA guidance actively and ensure your vendor list is kept current.
IAB Transparency and Consent Framework (TCF) Explained – GDPR Compliance Risks and Secure Privacy's Alternative Approach — covers what TCF is, how it interacts with Google Consent Mode, known DPA enforcement concerns, and when Secure Privacy's GCM-based approach is a simpler, lower-risk alternative.
9.3 Consent Re-collection & Validity Periods
Consent is not permanent. GDPR requires that consent be renewed whenever the purposes for which cookies are used change materially — for example, adding a new advertising network, switching analytics providers, or expanding cookie use to cover new categories. A visitor who consented to Google Analytics six months ago has not consented to a LinkedIn Insight Tag you added last week.
Regulatory guidance on maximum consent duration varies by authority. The CNIL (France) sets a ceiling of 13 months before re-consent must be sought; Irish DPC guidance for analytics cookies suggests a practical maximum closer to 6 months. As a baseline: any consent record older than 12 months should be treated as expired and visitors should be prompted again on their next session.
Practically, this means your implementation should:
- Store the timestamp of each consent decision alongside the decision itself
- Re-present the banner to returning visitors once their consent record has aged past your configured renewal threshold
- Re-present the banner any time you add a new cookie category or materially new service that was not disclosed at the time the original consent was collected
Secure Privacy logs a timestamped record of every consent decision in the Consent Dashboard. Defaults are correlated to the Template configuration, where most of the templates are set to 12 months, some 6 and most of the US to "Do not store". More information in this article here -
How to Change the Data Retention Period for a Legal Template in Secure Privacy
For guidance on how long to retain those records for your configuration — please consult your DPO or legal team — as this is an area where your legal or DPO team should set the threshold based on your processing activities and the DPAs most likely to scrutinise your site.
9.4 The "Consent Wall" — When Your Banner Becomes Invalid
A consent wall is any design that conditions access to website content on the visitor accepting non-essential cookies — "accept tracking or leave." The EDPB's Guidelines 05/2020 on consent are explicit: consent is not freely given if refusal results in a significant detriment to the user, and blocking access to a website constitutes exactly that detriment. A consent wall therefore produces invalid consent under GDPR, regardless of how well the underlying blocking and auditing is configured.
The same principle applies to subtler designs: pre-ticked boxes, dark patterns that make "Reject All" harder to reach than "Accept All," and banners that frame declining as an error or interruption all risk invalidating consent. The EDPB and national DPAs — particularly the CNIL, the Italian Garante, and the Irish DPC — have issued specific enforcement decisions on banner design and treat these patterns as violations independent of whether cookies are technically blocked correctly.
Practically: ensure your banner presents accept and reject options with equal visual prominence and equal number of clicks. There is no dedicated Secure Privacy support article on this topic; refer to EDPB Guidelines 05/2020 on Consent and your DPO for banner design review.
Frequently Asked Questions
Do I need to block cookies before the consent banner appears under GDPR?
Yes. GDPR Article 6 and the ePrivacy Directive require that non-essential cookies — including analytics and advertising cookies — must not be set until a visitor has given explicit prior consent. A banner that appears while tracking scripts are already running in the background is not compliant. The cookie must not be written to the visitor's device until consent is actively recorded.
Which cookies require prior consent under GDPR?
Any cookie that is not strictly necessary for a service explicitly requested by the user requires prior consent. This includes any of the mentioned cookie before, like Google Analytics (_ga, _gid), Facebook/Meta Pixel (_fbp, fr), Google Ads/DoubleClick (IDE, NID), YouTube (VISITOR_INFO1_LIVE), and LinkedIn Insight Tag cookies. Strictly necessary cookies — session authentication, shopping cart, security tokens — are exempt, because without these services - the very basic functionality of any website will be broken and it becomes unuable.
Why are my cookies still loading before the consent banner appears?
The most common causes are: (1) the Secure Privacy script is loading after the third-party scripts it is supposed to block — script load order is the most overlooked compliance detail; (2) the Secure Privacy script is using the async attribute instead of defer, creating a race condition; (3) a caching or performance plugin (such as WP Rocket) has reordered or re-attributed the scripts; or (4) a new script or pixel was added to the site after the last Secure Privacy scan, so it was never detected and added to the blocking configuration.
What is the difference between async and defer for cookie consent compliance?
Scripts with the async attribute execute as soon as they finish downloading — in no guaranteed order. If a Google Analytics script downloads faster than your CMP, it fires before consent is checked: a compliance violation. Scripts with defer download in parallel but execute in DOM order after HTML parsing completes. If Secure Privacy is the first deferred script in , it always executes first. Always use defer on the Secure Privacy script — never async.
Does Google Consent Mode v2 replace the need for a cookie consent banner or CMP?
No. Google Consent Mode v2 is an additional signal layer that tells Google tags how to behave based on consent your CMP collects — it does not itself collect or record consent from the visitor. A compliant CMP (such as Secure Privacy) is still required to present the banner, record the visitor's choice, and block non-essential cookies until that choice is made. GCM v2 and a CMP work together; neither replaces the other.
How often should I rescan my website for GDPR cookie compliance?
At minimum: immediately after every third-party script, pixel, or integration change; after any CMS, plugin, or theme update; after any Google Tag Manager container change; and at least once per quarter even if no known changes occurred. Automatic blocking only covers what the most recent scan detected — any script added after the last scan will not be blocked.
Quick Reference: All Related Guides
Guide
What it covers
Cookies Loading Before Consent? How to Fix Pre-Consent Cookie Loading
Identifying cookies that fire before consent; scan report walkthrough; GDPR compliance checklist
Automatic Cookie Blocking Explained (CMP v1 — steps apply, screenshots outdated)
How the MutationObserver blocking engine works; blocking modes; adding scripts to the blocking configuration
How to Manually Block Cookies Not Blocked Automatically (CMP v1 — steps apply, screenshots outdated)
Reading the red ✗ indicators in scan reports; Tag Blocking configuration; rescan verification
How to Set Up Manual Script and iframe Blocking (CMP v1 — steps apply, screenshots outdated)
Script type rewriting; sp-consent + data-src iframe pattern; YouTube/Vimeo blocking
How to Block Cookies in GTM Triggers Using Consent Conditions
Custom JavaScript variable pattern; sp.checkConsent(); adding consent conditions to existing triggers
How to Block Cookies in GTM Using Secure Privacy Consent Event Triggers
sp-consent custom event trigger pattern; one-trigger-per-service setup; multi-trigger edge case
Meta Consent Mode: How It Works & How to Enable It with Secure Privacy
Meta Pixel and Conversions API consent integration; regional configuration; verification steps
How to Enable Microsoft UET Consent Mode with Secure Privacy
Microsoft Advertising UET tag consent; EU ad_storage denied by default
How to Set Up Microsoft Clarity Consent Mode with Secure Privacy
Clarity consent commands; stop default for EU/EEA regions
IAB TCF Explained – GDPR Compliance Risks and Secure Privacy's Alternative Approach
TCF overview; DPA enforcement concerns; when GCM-based approach is the lower-risk alternative
---
# CIPA vs. CCPA: How to Review Your California Consent Banner and CMP Settings in Secure Privacy
URL: https://support.secureprivacy.ai/article/cipa-vs-ccpa-cmp-and-consent-banner-changes-in-secure-privacy
Product: Consent Management
Category: Compliance & Regulations
Published: 2026-03-11T11:32:00+00:00
Updated: 2026-03-26T01:42:12.404+00:00
Reading Time: 11 minutes
Summary: Does your CCPA banner cover CIPA wiretapping risk? Review four Secure Privacy settings — Consent Type, banner buttons, cookie widget, and Preference Center — in minutes.
California's wiretapping law — the California Invasion of Privacy Act (CIPA) — is creating a new wave of legal scrutiny for websites that use session replay tools, chat widgets, form analytics, and third-party tracking scripts. If your site serves California visitors, and those tools activate before a user has knowingly agreed to them, you may be exposed to CIPA liability under Penal Code sections 631 and 632 — even if you already have a CCPA-compliant consent banner in place.
That is the gap many website and legal teams are discovering right now. A standard CCPA opt-out consent model was designed for privacy rights and data disclosures. It was not necessarily designed with CIPA's interception standard in mind — and updating it often means revisiting whether an implicit opt-out approach is still appropriate for every technology on your site.
The instinct is to buy a new platform. In practice, the fix is almost always simpler: review and update the California template you already have in your consent management platform (CMP). If you use Secure Privacy, all four of the controls you need already exist — they just need to be checked against your current website stack and legal position.
By the end of this article, you will know exactly which four settings to review in Secure Privacy, what to look for in each one, and how to bring your California consent banner into alignment with both CCPA privacy requirements and the higher consent standard that CIPA questions are raising.
Who Is This Article For?
This guide is written for website managers, legal ops teams, and privacy engineers who already have a California consent banner live on their site — and who want to review whether that setup still reflects the tools running on the site, the current legal landscape in California, and their company's privacy disclosures. You do not need to replace your CMP. You need to know which settings to check.
CIPA vs. CCPA: What Website Teams Actually Need to Know
Many companies already use a California CCPA template in their CMP and assume the setup is complete. In practice, website teams are now revisiting those configurations as they compare CCPA privacy requirements with CIPA-related website risk questions.
That review usually does not mean replacing your CMP. It means checking whether the existing template in Secure Privacy is configured the right way for the tools running on the site.
At a high level:
- The CCPA focuses on privacy rights and disclosures, including notice at collection and the right to opt out of the sale or sharing of personal information. See California Civil Code sections 1798.100, 1798.120, and 1798.135.
- The California Invasion of Privacy Act (CIPA) raises separate questions under California Penal Code sections 631 and 632, which address interception and recording of communications.
For website teams, the practical question is:
Does your California banner setup still reflect what your site actually loads, tracks, and shares?
In Secure Privacy, there are four settings areas worth reviewing first.
Four Consent Banner Settings to Review in Secure Privacy
Step 1 — Review the Consent Type: Opt-In vs. Opt-Out for Your California Template
If your current California template was built mainly for CCPA rights management, the first setting to revisit is Consent Type.
In Secure Privacy, the California template supports:
- Explicit [Opt-in] — no tracking until the user actively accepts
- Implicit [Opt-out] — tracking proceeds by default until the user declines
If the template is currently set to Implicit [Opt-out], website teams may want to re-check whether that still fits all technologies running on the site — especially tools that go beyond basic analytics. That review is especially relevant for services such as:
- session replay tools
- chat widgets
- form analytics
- call tracking or call recording tools
- advertising or conversion pixels
- embedded third-party tools
The point is not that every service should automatically be moved to the same model. The point is that tools previously allowed under a broad opt-out setup may now need a more deliberate review — particularly any tool that could be characterised as intercepting or recording communications under CIPA.
Where to update this in Secure Privacy: Template → Settings → Consent Type
In Secure Privacy, website teams can review the California template's Consent Type and switch between Implicit [Opt-out] and Explicit [Opt-in] to match their current legal position.
Step 2 — Update the Cookie Banner to Eliminate Dark Patterns and Surface a Clear First-Layer Choice
Once the Consent Type is reviewed, the next place to look is the Cookie banner tab.
If your team wants users to make a clearer privacy choice, the first layer should be reviewed for:
- banner text
- accept button text
- decline button text
- customize button text
- category visibility
The California Privacy Protection Agency regulations state that agreement obtained through dark patterns does not constitute valid consent. The full regulations are published at CPPA Regulations — cppa.ca.gov. That makes button setup important: if the site is relying on consent for any category or service, website teams should review whether users can actually see and use the available choices.
What to review in the banner
- Is the Accept button text still too generic — for example, just "Okay"?
- Is the Decline button text enabled and visible?
- Is the Customize button text enabled so users can open the preference center?
- Are advanced categories turned on if you want users to make more granular selections?
Where to update this in Secure Privacy: Template → Cookie banner
Use the Cookie banner settings in Secure Privacy to surface Accept, Decline, and Customize options more clearly — and avoid CPPA dark-pattern concerns.
Suggested implementation review
If your current CCPA template uses an accept button labeled "Okay," no visible decline text, and no visible customize text, the setup likely deserves a second look. A practical update is to make the available user actions more explicit in the banner itself.
Step 3 — Update the Cookie Widget to Surface "Do Not Sell or Share" or "Your Privacy Choices" for California Users
After the banner is dismissed, many teams rely on the floating cookie widget as the persistent re-entry point for users who want to revisit their privacy choices. In Secure Privacy, this is controlled in the Cookie widget section of the Template.
The widget label often becomes the ongoing California privacy entry point for users. If the current widget text is too generic, website teams may want to review whether it should be more specific. Common labels teams evaluate include:
- Do Not Sell
- Do Not Sell or Share
- Your Privacy Choices
- Cookie Settings
Which text is appropriate depends on how the company is presenting its California privacy choices and how the preference center is configured. "Do Not Sell or Share" reflects the CCPA/CPRA language introduced by Proposition 24; "Your Privacy Choices" is a broader option accepted by CPPA guidance.
Where to update this in Secure Privacy: Template → Widget → Button text / Widget text
The Cookie widget text in Secure Privacy can be updated to reflect the California privacy choice you want to surface — such as "Do Not Sell or Share" or "Your Privacy Choices" — after the banner is closed.
This is one of the simplest changes to make, and one of the most visible to California users.
Step 4 — Review the Preference Center Labels and Descriptions to Match Your Actual Website Stack
If the banner points users into a preference center, the content of that experience should also be reviewed. In Secure Privacy, the Preference center lets you edit the tab names and descriptive copy shown to users — giving teams a place to align the consent experience with their actual privacy disclosures.
What to review in the Preference Center
- tab names
- descriptions
- privacy policy references
- category labels
- whether the wording still matches the services enabled on the site
For example, if your template language says only that the site uses cookies, but the site also uses chat, replay, or form-related tools, teams may want to review whether the wording remains accurate for users who are making a consent decision.
Where to update this in Secure Privacy: Template → Preference center
Use the Preference center in Secure Privacy to align tab labels, descriptions, and privacy links with the current website setup and the technologies you have deployed.
This is also the right place to review whether the user-facing privacy journey is too generic for the technologies actually in use on your site.
Where to Start: A Priority Review Checklist for Website Teams
If your California template has been live for a while, start with the items most likely to have been approved years ago as a standard business choice:
- analytics and measurement scripts
- ad and conversion pixels
- session replay tools
- chat services
- embedded third-party widgets
- form and lead-capture tools
Then compare those tools against your current Secure Privacy configuration:
- Is the template using the right Consent Type? (opt-in vs. opt-out)
- Does the banner show a clear first-layer choice? (accept, decline, and customize all visible)
- Is the Cookie widget labeled clearly enough for California users? (Do Not Sell or Share / Your Privacy Choices)
- Does the Preference Center language still match the tools on the site?
That review keeps the focus where it belongs: on implementation, not on platform replacement.
Why This Matters for Secure Privacy Users
The value of a consent management platform is not just that it displays a banner. The value is that it gives website teams a controlled place to update consent behavior, user-facing text, ongoing privacy access points, and preference-center content — without a development cycle. In Secure Privacy, those controls already exist in the California template. The practical work is making sure they still reflect your legal review, your website stack, and your current privacy choices.
Conclusion
A CIPA vs. CCPA review for your website almost never starts with buying a new platform. It starts with checking whether the existing California consent banner template is still configured correctly for the tools you are running today.
For most Secure Privacy users, the highest-impact updates are:
- reviewing Consent Type (opt-in vs. opt-out)
- updating banner buttons and text to eliminate dark patterns
- changing the Cookie widget label to "Do Not Sell or Share" or "Your Privacy Choices"
- revising the Preference Center copy to match the current website stack
Those four changes will usually tell you very quickly whether your California consent management setup still matches the site you are operating today.
Frequently Asked Questions
Does my CCPA consent banner also cover CIPA?
Not automatically. A standard CCPA consent banner is designed to give users notice and an opt-out right for the sale or sharing of personal information. CIPA (California Penal Code §§ 631–632) raises a separate question about whether tools that intercept or record communications — such as session replay, chat widgets, or call tracking — are operating with the user's prior consent. If those tools activate before a user has affirmatively agreed, an opt-out-only banner may not satisfy CIPA's standard. Reviewing your Consent Type in Secure Privacy is the starting point.
Do I need to switch from opt-out to opt-in for California users?
CCPA does not require opt-in consent as a baseline. However, if your site uses tools that could be categorised as intercepting communications under CIPA — such as session replay, live chat recording, or certain form analytics — your legal team may recommend opt-in consent for those specific categories or technologies. In Secure Privacy, you can set the California template to Explicit [Opt-in] for all categories, or review which tool categories warrant the higher standard.
What is a dark pattern in a cookie consent banner?
Under the California Privacy Protection Agency (CPPA) regulations, a dark pattern is a user interface design that subverts or impairs a user's ability to make a free and genuine choice — for example, making the "Accept" button prominent and brightly coloured while hiding the "Decline" button, or not showing a decline option at all on the first layer. The CPPA has stated that consent obtained through dark patterns is not valid. Reviewing your banner's button text and visibility in Secure Privacy's Cookie banner settings is the practical fix.
Should the Cookie widget say "Do Not Sell" or "Do Not Sell or Share"?
"Do Not Sell or Share My Personal Information" is the more current phrasing, reflecting the CPRA (Proposition 24) amendments to CCPA that added a right to opt out of sharing for cross-context behavioural advertising. "Do Not Sell" was the original CCPA language. The CPPA also accepts "Your Privacy Choices" as an alternative label. Which you use depends on your company's privacy disclosures and legal guidance. In Secure Privacy, the Cookie widget text can be updated directly under Template → Widget.
How often should I review my California consent banner configuration?
A good rule of thumb is to review your California consent banner configuration whenever you add or remove a technology from your website stack, after any significant change in California privacy regulations or CPPA guidance, and at least annually as a routine audit. Because CIPA litigation often targets tools that were added to a site without updating the consent layer, keeping the banner configuration in sync with the actual website stack is the most practical risk-reduction step.
Primary Sources
- California Civil Code § 1798.100 — Right to Know (leginfo.legislature.ca.gov)
- California Civil Code § 1798.120 — Right to Opt Out (leginfo.legislature.ca.gov)
- California Civil Code § 1798.135 — Opt-Out Methods (leginfo.legislature.ca.gov)
- California Penal Code § 631 — CIPA Wiretapping (leginfo.legislature.ca.gov)
- California Penal Code § 632 — CIPA Recording (leginfo.legislature.ca.gov)
- California Privacy Protection Agency (CPPA) Regulations — cppa.ca.gov
Related Articles
- Setting Up Your California CCPA Template in Secure Privacy[?]
- Opt-In vs. Opt-Out Consent: When to Use Each in Your CMP[?]
- Configuring the Do Not Sell or Share Button for CCPA Compliance
- CPPA Dark Pattern Rules: What Your Cookie Banner Must Avoid[?]
---
# Healthcare GDPR Compliance – Special Category Health Data, Article 9 Requirements, and DPO Guidance
URL: https://support.secureprivacy.ai/article/industry-specific-dpo-guidance-healthcare
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T20:30:00+00:00
Updated: 2026-03-22T01:21:41.705+00:00
Reading Time: 6 minutes
Summary: Learn how Secure Privacy's DPO manages GDPR compliance for healthcare — covering Article 9 special category health data, patient rights, research data use, telemedicine, and clinical access controls.
Healthcare organizations process some of the most sensitive personal data of any sector — including patient medical records, genetic data, mental health records, and biometric data, all classified as special category data under GDPR Article 9. Processing this data requires satisfying both a lawful basis under Article 6 and an additional condition under Article 9(2), alongside national healthcare data protection laws, professional confidentiality obligations, and sector-specific regulatory requirements. Your Secure Privacy DPO provides specialized guidance for navigating this complex landscape — from access controls and patient rights through to research data use and telemedicine compliance.
Who Is This For?
- Data Protection Officers and privacy managers in healthcare organizations managing GDPR Article 9 compliance
- Clinical and administrative teams processing patient health data across electronic health record systems
- Legal and compliance teams reviewing data sharing arrangements, research protocols, and vendor agreements
- IT and information governance teams implementing access controls and security measures for health data systems
GDPR Healthcare Special Category Data: Key Categories and Considerations
Healthcare organizations process multiple types of special category data, each with distinct compliance requirements under GDPR Article 9:
Data Type
GDPR Classification
Special Compliance Considerations
Patient medical records
Special category — health data
Requires Article 9(2) condition; strict role-based access controls; long statutory retention periods
Genetic data
Special category
Additional protections under national law in many jurisdictions; purpose limitation is critical
Biometric data used for identification
Special category
Special category status applies only when used to uniquely identify an individual
Mental health records
Special category — health data
Heightened confidentiality requirements; access more restricted than general health data in many jurisdictions
Staff health screening results
Special category — health data
Employment law considerations; limited to occupational health purposes; strict access restrictions
DPO Focus Areas for Healthcare GDPR Compliance
Lawful bases and Article 9(2) conditions
Your DPO identifies the correct Article 9(2) condition for each health data processing activity — most commonly healthcare provision under Article 9(2)(h), public health under Article 9(2)(i), explicit consent under Article 9(2)(a), or substantial public interest. Both an Article 6 lawful basis and an Article 9(2) condition must be documented for every processing activity involving health data.
Data minimization in clinical systems
Your DPO advises on collecting only the health data strictly necessary for the specific treatment, administrative, or research purpose — reviewing clinical system configurations, intake forms, and data collection points to remove unnecessary fields and prevent over-collection.
Role-based access controls for patient data
Your DPO works with IT and clinical governance teams to implement and audit role-based access controls that restrict patient data access to authorized personnel only — ensuring clinical staff can access only the records necessary for their specific care role.
Data sharing between healthcare providers, insurers, and researchers
Your DPO manages the legal framework for health data sharing — including Data Processing Agreements, data sharing agreements, and appropriate Article 9(2) conditions for each sharing arrangement — covering referrals, multi-disciplinary care, insurance processing, and research collaborations.
Medical research and patient data use
Your DPO advises on the use of patient data for clinical research, epidemiological studies, and quality improvement — including requirements for anonymization, pseudonymization, ethics committee approvals, and the research exemptions available under GDPR Article 9(2)(j) and applicable national research law.
Telemedicine and remote healthcare data protection
Your DPO reviews telemedicine platforms for GDPR compliance — including security of video consultation data, cross-border data flows, patient consent mechanisms, and the obligations of technology vendors as data processors under GDPR Article 28.
Patient rights in a clinical context
Your DPO ensures processes are in place for patients to exercise their GDPR data subject rights — including access requests that may require clinical judgment about disclosure, erasure requests that conflict with statutory medical record retention obligations, and objection rights in research contexts.
Healthcare GDPR Compliance Requirements and DPO Recommendations
Conduct DPIAs for all new clinical systems and data sharing arrangements
Any new system or arrangement involving large-scale health data processing is highly likely to require a Data Protection Impact Assessment under GDPR Article 35. Your DPO conducts pre-screening and manages the full DPIA process before deployment.
Implement clinical staff data protection training
Clinical staff handle special category data daily — often under time pressure and across multiple systems. Your DPO delivers role-specific training covering health data handling obligations, incident reporting procedures, and patient rights responses tailored to the clinical environment.
Establish clear research data use policies
Your DPO develops documented policies for the use of patient data in research, covering consent or waiver requirements, anonymization standards, data access governance, and obligations under applicable clinical research regulations alongside GDPR.
Comply with national healthcare data protection laws
GDPR is supplemented by national healthcare data protection legislation in many EU member states — imposing additional obligations on health data processors beyond the GDPR baseline. Your DPO identifies and monitors the applicable national requirements for your jurisdiction.
Maintain detailed records of all health data processing activities
Given the sensitivity of health data and the frequency of supervisory authority scrutiny in the healthcare sector, maintaining a current and comprehensive ROPA covering all health data processing activities is essential. Your DPO creates and maintains these records as part of your ongoing compliance program.
Review electronic health record and medical device data processing
Electronic health record systems, connected medical devices, and interoperability frameworks all create data flows that must be assessed for GDPR compliance — including vendor DPA coverage, data residency requirements, and purpose limitation controls. Your DPO oversees these assessments as part of the annual compliance review.
Frequently Asked Questions
What Article 9(2) condition is most commonly used for healthcare data processing?
The most widely applicable condition for healthcare organizations is Article 9(2)(h), which permits processing of health data for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care treatment, or the management of health systems — subject to professional secrecy obligations. Article 9(2)(i) applies to public health purposes, and Article 9(2)(j) to archiving, research, and statistical purposes in the public interest.
Can patients request erasure of their medical records?
The right to erasure under GDPR Article 17 does not apply where retention is required for compliance with a legal obligation — and healthcare organizations are typically subject to statutory minimum retention periods for medical records under national law. Where a statutory retention obligation applies, erasure requests can be refused. Your DPO advises on the correct response and ensures patients are informed of the applicable retention basis.
Does GDPR apply to anonymized patient data used in research?
Truly anonymized data falls outside the scope of GDPR, as it can no longer be used to identify an individual. However, the anonymization standard is high — pseudonymized data, which can be re-identified using a separate key, remains personal data and is subject to GDPR. Your DPO advises on whether proposed anonymization methods meet the GDPR standard before research data is treated as out of scope.
Are telemedicine platforms subject to GDPR?
Yes. Telemedicine platforms that process patient health data — including video consultation recordings, symptom data, and diagnostic information — are subject to GDPR as data processors. They must be covered by a compliant Data Processing Agreement, and your DPO should review the platform's security measures, data residency, and subprocessor arrangements before deployment.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# E-Commerce GDPR Compliance – Data Protection for Online Retail, Marketing Consent, and Cookie Management
URL: https://support.secureprivacy.ai/article/industry-specific-dpo-guidance-ecommerce-retail
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T20:30:00+00:00
Updated: 2026-03-22T01:19:54.297+00:00
Reading Time: 6 minutes
Summary: Learn how Secure Privacy's DPO manages GDPR compliance for e-commerce — covering customer data, cookie consent, marketing opt-ins, payment data, vendor management, and cross-border sales.
E-commerce and online retail organizations process some of the highest volumes of personal data of any sector — including customer account data, payment card information, behavioral tracking, marketing profiles, and delivery records. GDPR, the ePrivacy Directive, and sector-specific requirements such as PCI DSS all apply simultaneously, creating a complex compliance landscape. Your Secure Privacy DPO provides targeted guidance on managing e-commerce data protection obligations — from cookie consent and marketing compliance through to vendor management and cross-border sales.
Who Is This For?
- E-commerce operators and online retailers processing customer personal data under GDPR
- Marketing and CRM teams managing email marketing, retargeting, and customer profiling
- IT and development teams implementing checkout flows, tracking technologies, and analytics tools
- Legal and compliance teams reviewing vendor agreements, privacy notices, and cross-border data flows
GDPR E-Commerce Data Types and Compliance Requirements
Online retail organizations process a wide range of personal data categories, each with its own compliance considerations:
Data Type
Processing Purpose
Key Compliance Consideration
Customer account data
Account management, order processing
Data minimization; defined retention limits post-account closure
Transaction records
Order fulfillment, returns, accounting
Retention aligned with tax and accounting law obligations
Payment card data
Payment processing
PCI DSS compliance; tokenization; minimize post-transaction retention
Browsing behavior
Personalization, analytics, A/B testing
Cookie consent under ePrivacy Directive; profiling transparency under GDPR Article 22
Marketing preferences
Email marketing, retargeting, segmentation
Valid consent management; functional opt-out mechanisms
Delivery addresses
Shipping and logistics
Third-party sharing with carriers; DPA requirements for logistics providers
Customer service records
Support, complaints, dispute resolution
Defined retention periods; role-based access controls for support teams
DPO Focus Areas for E-Commerce GDPR Compliance
Marketing compliance under GDPR and ePrivacy
Your DPO ensures email marketing, behavioral retargeting, and customer profiling activities comply with both GDPR consent requirements and ePrivacy Directive rules — including obtaining valid opt-in consent, maintaining suppression lists, and ensuring marketing platforms are covered by compliant Data Processing Agreements.
Cookie consent and tracking technology management
E-commerce sites typically deploy a large number of third-party tracking scripts — analytics, advertising pixels, A/B testing, and personalization tools. Your DPO oversees regular cookie audits, consent banner configuration, and Google Consent Mode V2 implementation to ensure all tracking technologies are covered by valid prior consent.
Payment data and PCI DSS coordination
Your DPO coordinates GDPR compliance requirements with PCI DSS obligations for payment data processing — advising on tokenization, data minimization post-transaction, and the correct scope of payment data retention to satisfy both frameworks simultaneously.
Third-party vendor management
E-commerce operations typically involve multiple data processors — payment providers, logistics partners, marketing platforms, analytics tools, and marketplace operators. Your DPO manages the vendor register, reviews and maintains Data Processing Agreements, and conducts regular compliance assessments for all third parties with access to customer personal data.
Cross-border sales and international data compliance
When selling to customers across different jurisdictions, additional data protection obligations may apply — including GDPR for EU customers, UK GDPR for UK customers, CCPA for California residents, and local ePrivacy rules. Your DPO advises on the applicable requirements for each market and ensures your privacy notices, consent mechanisms, and data transfer arrangements reflect your geographic footprint.
Customer profiling and automated decision-making
Personalization engines, recommendation algorithms, and dynamic pricing tools may constitute automated decision-making or profiling under GDPR Article 22. Your DPO advises on when Article 22 applies, what transparency obligations it triggers, and whether a DPIA is required before deploying profiling-based features.
Common E-Commerce GDPR Compliance Failures and How to Avoid Them
Retaining customer data indefinitely
Storing customer account and transaction data without a defined retention schedule is one of the most common e-commerce GDPR failures. Your DPO implements a documented retention policy aligned with tax law, contractual limitation periods, and the storage limitation principle under Article 5(1)(e).
Sharing customer data with marketing partners without adequate consent
Passing customer data to third-party advertising platforms or data brokers without transparent disclosure and valid consent is a significant enforcement risk. Your DPO ensures data sharing practices are disclosed in privacy notices and covered by the correct lawful basis.
Pre-checked marketing opt-in boxes at checkout
Pre-ticked marketing consent boxes do not constitute valid GDPR consent. Your DPO reviews checkout flows to ensure all marketing opt-ins are active, affirmative choices — with no default selection applied.
Failing to update privacy policies when new tracking technologies are deployed
When new analytics tools, advertising pixels, or personalization scripts are added to a website, privacy notices and cookie policies must be updated before deployment. Your DPO establishes a change management process to ensure privacy documentation is always current.
Inadequate DPA coverage for marketplace and logistics vendors
Third-party marketplace sellers and logistics providers who access customer personal data must be covered by a compliant Data Processing Agreement. Your DPO identifies gaps in vendor coverage and ensures all processors are brought into a documented GDPR compliance framework.
Privacy by Design Best Practices for E-Commerce
- Implement privacy-by-design principles in the checkout flow — collecting only the minimum personal data required to complete the transaction
- Use granular consent for different marketing channels — separate opt-ins for email, SMS, and push notifications rather than a single blanket consent
- Conduct regular cookie audits as product pages, A/B tests, and third-party integrations change
- Maintain an up-to-date vendor register with scheduled compliance reviews for all data processors
- Provide clear, accessible privacy information at every data collection point — account registration, checkout, newsletter signup, and contact forms
Frequently Asked Questions
Does GDPR apply to e-commerce businesses based outside the EU that sell to EU customers?
Yes. GDPR applies to any organization that offers goods or services to individuals in the EU — regardless of where the organization is based. E-commerce operators targeting EU customers must comply with GDPR for all personal data collected from those customers, including appointing an EU representative under GDPR Article 27 if they have no EU establishment.
Is email marketing to existing customers lawful without new consent?
In many EU member states, the ePrivacy Directive's "soft opt-in" rule permits direct marketing to existing customers for similar products or services — without requiring fresh consent — provided the customer was given a clear opportunity to opt out at the time their data was collected and in every subsequent communication. Your DPO advises on whether the soft opt-in applies in your specific circumstances and jurisdictions.
What lawful basis should e-commerce businesses use for customer profiling?
The appropriate lawful basis depends on the nature and purpose of the profiling. Behavioral profiling for personalization may rely on legitimate interests — subject to a Legitimate Interest Assessment — or on consent where the profiling involves cookie-based tracking. Where profiling produces decisions with significant effects on individuals, GDPR Article 22 may apply, requiring explicit consent or another Article 22(2) condition.
What are the GDPR requirements for abandoned cart emails?
Sending abandoned cart emails constitutes direct marketing and requires a valid lawful basis — typically consent or the soft opt-in under the ePrivacy Directive. The customer must have been clearly informed that their data may be used for this purpose, and a functioning opt-out mechanism must be provided in every communication. Your DPO reviews abandoned cart workflows to ensure they meet both GDPR and ePrivacy requirements.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# GDPR Employee Data Compliance – HR Data Lifecycle, Lawful Bases, Workplace Monitoring, and Staff Privacy Rights
URL: https://support.secureprivacy.ai/article/how-your-dpo-supports-employee-data-protection
Product: DPO as a Service
Category: DPO Operations
Published: 2026-03-09T20:30:00+00:00
Updated: 2026-03-22T00:59:23.141+00:00
Reading Time: 5 minutes
Summary: Learn how Secure Privacy's DPO manages GDPR compliance for employee data — covering HR data lifecycle, lawful bases, workplace monitoring DPIAs, and employee privacy rights.
Organizations process large volumes of employee personal data throughout the entire employment lifecycle — from recruitment and onboarding through to post-employment record retention. GDPR applies to HR data processing in the same way it applies to customer data, and national employment laws add further obligations in many jurisdictions. Your Secure Privacy DPO provides expert guidance on handling employee data lawfully, minimizing risk in high-risk areas such as workplace monitoring, and ensuring staff can exercise their data subject rights.
Who Is This For?
- HR managers and people operations teams responsible for employee data handling and retention
- Data Protection Officers advising on lawful bases and compliance for HR data processing
- Legal and compliance teams reviewing employment contracts, monitoring practices, and retention schedules
- IT and security teams managing access controls for employee personal data systems
Why GDPR Employee Data Compliance Matters
Employee personal data — including payroll records, performance reviews, health declarations, and monitoring outputs — is subject to the full scope of GDPR obligations. Unlike customer data, HR data processing often involves special category data (such as health information) and inherently sensitive contexts such as disciplinary proceedings and workplace monitoring. Mishandling employee data is a growing area of regulatory scrutiny and can result in enforcement action, employee complaints to supervisory authorities, and reputational damage.
GDPR Employee Data Lifecycle
Employee personal data flows through six distinct phases, each with its own data types, lawful bases, and compliance considerations:
Phase
Data Types
Key Compliance Considerations
Recruitment
CVs, applications, interview notes, references
Retention limits for unsuccessful candidates; transparency requirements at point of collection
Onboarding
ID documents, bank details, emergency contacts, health declarations
Data minimization; secure storage; clear lawful basis for each data type
Employment
Payroll, performance reviews, absence records, training records
Access controls; purpose limitation; employee rights to access and rectification
Monitoring
Email logs, internet usage, CCTV footage, access logs
Proportionality assessment; DPIA requirement; transparent employee notice
Termination
Exit interview data, reference requests
Defined retention schedules; data portability obligations where applicable
Post-Employment
Pension records, tax records, references
Legal retention periods under national law; secure deletion after retention period
Lawful Bases for HR and Employee Data Processing Under GDPR
Your DPO advises on the correct lawful basis for each category of employee data processing. The four most relevant bases in an employment context are:
- Contract performance (Article 6(1)(b)): Processing necessary to fulfil the employment contract — including payroll, benefits administration, and managing leave entitlements.
- Legal obligation (Article 6(1)(c)): Processing required by law — including tax reporting, health and safety obligations, and right-to-work verification.
- Legitimate interests (Article 6(1)(f)): Performance management, fraud prevention, and internal administration — subject to a careful balancing test to ensure employee interests are not overridden.
- Consent (Article 6(1)(a)): Rarely appropriate in employment contexts due to the inherent power imbalance between employer and employee. Used only sparingly for genuinely voluntary activities where freely given consent can be demonstrated.
Workplace Monitoring and GDPR: High-Risk Processing
Workplace monitoring — including email surveillance, internet usage tracking, CCTV, and access log monitoring — is a high-risk area of employee data processing that frequently requires a Data Protection Impact Assessment (DPIA). Your DPO advises your organization on all aspects of lawful monitoring:
Necessity and proportionality
Assess whether the proposed monitoring is necessary to achieve its stated purpose and whether less intrusive methods could achieve the same result. Monitoring that is disproportionate to its objective is unlikely to be lawful.
Choosing least-intrusive methods
Your DPO advises on which monitoring methods are least intrusive relative to the compliance or operational objective, reducing GDPR risk while meeting legitimate business needs.
Employee transparency and notice
Employees must be clearly informed about what is monitored, why, how data is used, and how long it is retained — typically through an employee privacy notice and acceptable use policies.
Monitoring data retention periods
Monitoring outputs must not be retained longer than necessary for their stated purpose. Your DPO defines proportionate retention periods for each monitoring type.
Access controls for monitoring outputs
Access to monitoring data must be restricted to those with a legitimate need. Your DPO advises on access control frameworks to prevent misuse of sensitive monitoring outputs.
Employee GDPR Privacy Rights in the Workplace
Employees hold the same data subject rights under GDPR as any other individual. Your DPO ensures your organization has clear processes in place for employees to exercise the following rights:
- Right of access (Article 15): Employees can request a copy of their personal data held by the employer.
- Right to rectification (Article 16): Employees can request correction of inaccurate HR records.
- Right to erasure (Article 17): Applicable in limited circumstances — employer legal obligations to retain records often override erasure requests.
- Right to object (Article 21): Employees can object to processing based on legitimate interests, such as certain monitoring activities.
Your DPO advises on balancing employee rights against employer obligations — particularly where legal retention requirements or contractual obligations limit the scope of erasure or objection rights.
Frequently Asked Questions
Can employers use consent as a lawful basis for processing employee data?
Consent is rarely appropriate in employment contexts. GDPR requires that consent be freely given — but the power imbalance between employer and employee means employees may not feel able to refuse or withdraw consent without fear of consequences. Your DPO advises on identifying alternative lawful bases for employee data processing wherever consent is being considered.
Is workplace monitoring under GDPR always subject to a DPIA?
Not always, but systematic or large-scale monitoring of employees is highly likely to require a DPIA under GDPR Article 35. This includes continuous email monitoring, widespread CCTV use, and keystroke logging. Your DPO conducts a pre-screening assessment to determine whether a full DPIA is required before any new monitoring activity is introduced.
How long can employers retain employee personal data after termination?
Retention periods for post-employment data vary by data type and applicable national law. Tax and payroll records typically carry statutory retention periods of several years. Your DPO establishes a documented HR data retention schedule that aligns with both GDPR data minimization requirements and applicable legal obligations in your jurisdiction.
Do employees have the right to access their performance reviews and disciplinary records?
Yes. Under GDPR Article 15, employees can submit a Data Subject Access Request (DSAR) to obtain a copy of any personal data the employer holds about them, including performance appraisals, disciplinary records, and absence data — subject to any applicable exemptions, such as where disclosure would reveal confidential third-party information.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# GDPR Lawful Bases for Processing – Article 6 Guide, Legitimate Interest Assessments, and Special Category Data
URL: https://support.secureprivacy.ai/article/dpo-advisory-on-lawful-bases-for-processing
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T20:29:00+00:00
Updated: 2026-03-22T01:16:22.122+00:00
Reading Time: 6 minutes
Summary: Learn the six GDPR Article 6 lawful bases for processing personal data, when each applies, how Legitimate Interest Assessments work, and what Article 9 requires for special category data.
Every personal data processing activity must be grounded in one of the six lawful bases for processing defined in GDPR Article 6. Selecting the wrong lawful basis — or failing to document the basis chosen — is one of the most common GDPR compliance failures and can invalidate an organization's entire processing activity. Your Secure Privacy DPO advises on lawful basis selection for each processing activity, conducts Legitimate Interest Assessments (LIAs) where required, and ensures the correct basis is communicated to data subjects and documented in your Record of Processing Activities (ROPA).
Who Is This For?
- Data Protection Officers and privacy managers advising on GDPR Article 6 compliance
- Legal and compliance teams documenting lawful bases for processing activities in the ROPA
- Marketing teams relying on consent or legitimate interests for customer data processing
- HR and IT teams identifying lawful bases for employee and operational data processing
Why Choosing the Correct GDPR Lawful Basis Matters
The lawful basis selected for a processing activity determines the rights available to data subjects, the conditions under which processing can continue, and what your organization must communicate in its privacy notices. Relying on the wrong basis — for example, using consent when contract performance is more appropriate — can expose your organization to enforcement action, undermine the validity of consent obtained, and create inconsistencies in your ROPA and privacy documentation that supervisory authorities will identify during investigations.
The Six GDPR Article 6 Lawful Bases for Processing
GDPR Article 6 provides six lawful bases for processing personal data. Your DPO advises on which basis applies to each of your organization's processing activities:
Lawful Basis
GDPR Reference
When to Use
Consent
Article 6(1)(a)
The individual has given clear, specific, informed, and unambiguous consent to the processing for a defined purpose
Contract
Article 6(1)(b)
Processing is necessary for the performance of a contract with the individual, or to take pre-contractual steps at their request
Legal Obligation
Article 6(1)(c)
Processing is necessary to comply with a legal obligation to which the controller is subject under EU or member state law
Vital Interests
Article 6(1)(d)
Processing is necessary to protect the vital interests of the data subject or another person — typically life-threatening situations
Public Task
Article 6(1)(e)
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
Legitimate Interests
Article 6(1)(f)
Processing is necessary for the legitimate interests of the controller or a third party, unless overridden by the individual's rights and freedoms
How Your DPO Advises on GDPR Lawful Basis Selection
Purpose analysis
Your DPO works with relevant teams to understand the specific, defined purpose of each processing activity — the starting point for identifying the most appropriate lawful basis.
Basis assessment
Your DPO evaluates which lawful basis or bases are most appropriate for the processing, considering the nature of the data, the relationship with the data subject, and any applicable legal obligations. Where multiple bases could apply, your DPO advises on the most defensible choice.
Documentation in the ROPA
The chosen lawful basis and the reasoning behind the selection are recorded in your Record of Processing Activities (ROPA) — providing the documented accountability trail required under GDPR Article 5(2).
Privacy notice update
GDPR Article 13 and 14 require that the lawful basis for processing be communicated to data subjects in your privacy notice. Your DPO ensures privacy notices are updated to reflect the correct basis for each processing activity.
Ongoing lawful basis review
Lawful bases must be reassessed when processing purposes change, new processing activities are introduced, or regulatory guidance shifts. Your DPO conducts periodic reviews and updates documentation accordingly.
Legitimate Interest Assessment (LIA): The Three-Part Test
When your organization relies on legitimate interests as its lawful basis under Article 6(1)(f), your DPO conducts a Legitimate Interest Assessment (LIA) to confirm the basis is valid and defensible. The LIA applies a structured three-part test:
- Purpose test: Is there a genuine legitimate interest behind the processing? The interest must be real, present, and not trivial — commercial interests, security interests, and administrative efficiency can all qualify, provided they are sufficiently clear and specific.
- Necessity test: Is the processing actually necessary to achieve the legitimate interest? If the same result could be achieved through less privacy-intrusive means, legitimate interests may not be an appropriate basis.
- Balancing test: Do the legitimate interests of the controller override the privacy rights, freedoms, and interests of the data subject? This is the most critical part of the assessment — factors include the nature of the data, the reasonable expectations of the individual, and the potential impact of the processing.
Your DPO documents the LIA in full, providing a written record that can be produced for supervisory authorities or data subjects who exercise their right to object under GDPR Article 21.
Special Category Data: GDPR Article 9 Additional Conditions
Processing special categories of personal data under GDPR Article 9 — including health data, biometric data, racial or ethnic origin, religious beliefs, sexual orientation, trade union membership, and genetic data — requires your organization to satisfy two separate legal requirements simultaneously:
- A lawful basis under GDPR Article 6 for the processing activity
- An additional condition under GDPR Article 9(2) — such as explicit consent, employment law obligations, vital interests, or substantial public interest — that specifically permits the processing of special category data
Your DPO ensures both conditions are identified, documented, and reflected in your ROPA and privacy notices before any special category data processing begins. Relying on an Article 6 lawful basis alone is not sufficient for special category data.
Frequently Asked Questions
Can an organization rely on more than one lawful basis for the same processing activity?
Organizations should identify a single primary lawful basis for each processing activity before processing begins. While it is possible to document an alternative basis in some circumstances, switching between bases after the fact — particularly switching from consent to legitimate interests when consent is withdrawn — is not permitted and is a recognized enforcement finding.
Is consent always the strongest lawful basis for processing?
Not necessarily. Consent requires ongoing management, can be withdrawn at any time, and is inappropriate in contexts where there is a power imbalance (such as employment). Where contract performance or legal obligation genuinely applies, those bases are more appropriate and more stable than consent. Your DPO advises on the most suitable basis for each activity.
What happens if an organization cannot identify a lawful basis for a processing activity?
If no lawful basis applies to a processing activity, the processing must not take place. Your DPO will advise on whether the processing can be restructured to fall within a lawful basis, whether it should be discontinued, or whether a different approach to achieving the same organizational objective is available without requiring the processing of personal data.
What is the difference between consent under Article 6(1)(a) and explicit consent under Article 9(2)(a)?
Standard consent under Article 6(1)(a) must be freely given, specific, informed, and unambiguous — and can be expressed through a clear affirmative action. Explicit consent under Article 9(2)(a) for special category data requires a higher standard — the consent must be expressed in explicit terms, typically in writing, and must clearly reference the specific type of special category data being processed.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# Cookie Compliance Under GDPR and ePrivacy – Cookie Categories, Consent Requirements, and DPO Guidance
URL: https://support.secureprivacy.ai/article/dpo-guidance-cookie-compliance-consent-management
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T20:29:00+00:00
Updated: 2026-03-22T01:14:02.538+00:00
Reading Time: 6 minutes
Summary: Learn how Secure Privacy's DPO manages cookie compliance under GDPR and the ePrivacy Directive — covering consent categories, cookie banners, Google Consent Mode V2, and common pitfalls.
Cookie compliance sits at the intersection of the ePrivacy Directive and GDPR. While the ePrivacy Directive governs the requirement to obtain consent before placing non-essential cookies, GDPR sets the standard for what valid consent looks like — freely given, specific, informed, and unambiguous. Your Secure Privacy DPO ensures your organization's cookie practices satisfy both frameworks, working alongside the Secure Privacy Consent Management Platform (CMP) to keep your cookie banner, preference center, and consent records fully compliant.
Who Is This For?
- Data Protection Officers and privacy managers responsible for cookie and consent compliance
- Marketing and analytics teams using tracking technologies, advertising cookies, or third-party scripts
- Web developers and IT teams implementing cookie banners, consent management platforms, and Google Consent Mode
- Legal and compliance teams reviewing cookie policies and consent mechanisms for GDPR and ePrivacy compliance
How Cookies and GDPR Interact
The ePrivacy Directive requires prior informed consent before placing non-essential cookies on a user's device. GDPR Article 7 defines the standard that consent must meet to be legally valid — including requirements for freely given consent, granular choice per cookie category, equal prominence of accept and reject options, and the right to withdraw consent as easily as it was given. Organizations that fail to align their cookie consent practices with both frameworks face enforcement risk from supervisory authorities and, increasingly, from data subject complaints.
GDPR Cookie Consent Categories
Cookies are classified into four categories based on their purpose. Consent requirements differ by category:
Category
Consent Required
Examples
Strictly Necessary
No
Session cookies, authentication, security cookies, load balancing
Functional
Yes
Language preferences, user settings, accessibility options
Analytics
Yes
Google Analytics, traffic measurement, A/B testing tools
Marketing
Yes
Advertising cookies, social media tracking pixels, retargeting scripts
The DPO's Role in Cookie and Consent Compliance
Cookie audit review and classification
Your DPO reviews regular cookie scan results to verify that all cookies deployed on your website are correctly identified, categorized, and declared — including third-party scripts loaded by analytics and marketing tools.
Consent mechanism review
Your DPO advises on consent mechanisms to ensure they meet GDPR Article 7 requirements — including freely given consent, equal prominence of accept and reject options, granular category-level choice, and easy withdrawal.
Cookie banner and preference center implementation
Your DPO reviews cookie banner design and preference center configuration to ensure the implementation reflects best practice guidance from supervisory authorities and does not use dark patterns that nudge users toward acceptance.
Cookie policy accuracy and completeness
Your DPO reviews your cookie policy to confirm it accurately reflects all cookies in use, provides clear descriptions of each cookie's purpose and retention period, and is updated whenever new cookies are added or existing ones change.
Google Consent Mode and IAB TCF compliance
Your DPO advises on the correct implementation of Google Consent Mode V2 and IAB Transparency and Consent Framework (TCF) requirements — ensuring your CMP integration signals consent correctly to advertising and analytics partners.
Regulatory guidance monitoring
Your DPO tracks emerging cookie enforcement decisions, supervisory authority guidance, and ePrivacy Regulation developments — updating your consent framework proactively as the regulatory landscape evolves.
Cookie Consent Management Platform Integration
Your DPO works directly alongside the Secure Privacy Consent Management Platform to ensure end-to-end cookie compliance:
- Regular cookie scanning: Automated scans identify new and changed cookies before they create compliance gaps in your consent records.
- Consent record maintenance: All consent events are logged and stored in line with GDPR accountability requirements — providing an auditable record for regulatory inspection.
- Opt-out mechanism verification: Your DPO verifies that reject and withdraw consent functions operate correctly across all cookie categories and do not require additional steps beyond accepting.
- Cross-domain consent management: Where your organization operates multiple domains, your DPO ensures cross-domain consent is correctly implemented and recognized across all properties.
- Change management: When new cookies or tracking technologies are introduced, your DPO ensures consent requirements are reviewed and updated before deployment.
Common Cookie Compliance Pitfalls Under GDPR
Pre-checked consent boxes
Pre-ticked checkboxes do not constitute valid consent under GDPR Article 7 or the ePrivacy Directive. Consent must be an active, affirmative action — silence or pre-selection is explicitly excluded.
Cookie walls blocking access without consent
Requiring users to accept all cookies as a condition of accessing content is problematic under most supervisory authority guidance, as it prevents consent from being freely given. Your DPO advises on compliant alternatives.
Incorrect cookie categorization
Classifying analytics or marketing cookies as "strictly necessary" to avoid requiring consent is a frequently cited enforcement finding. Your DPO reviews all cookie classifications to ensure they reflect the cookie's actual function.
Failing to update cookie policies when new cookies are added
Cookie policies must accurately reflect all cookies currently deployed. When new tools, scripts, or third-party integrations are added, cookie policies and consent banners must be updated before the new cookies are placed.
Incomplete or inaccurate cookie declarations
Cookie declarations must include the name, provider, purpose, and retention period for each cookie. Incomplete or generic descriptions — such as listing only cookie categories without naming individual cookies — do not satisfy transparency requirements under GDPR and the ePrivacy Directive.
Frequently Asked Questions
Does GDPR apply to cookies directly?
GDPR does not regulate cookies directly — that is the role of the ePrivacy Directive. However, GDPR sets the standard for what constitutes valid consent, which applies to cookie consent under the ePrivacy Directive. Organizations must satisfy both frameworks: ePrivacy for when consent is required, and GDPR for how that consent must be obtained and recorded.
Are analytics cookies strictly necessary?
No. Analytics cookies — including Google Analytics — are not strictly necessary for the website to function and require prior consent under the ePrivacy Directive. Supervisory authorities across the EU have consistently confirmed this position in enforcement decisions against organizations treating analytics cookies as exempt from consent requirements.
What is Google Consent Mode V2 and is it required?
Google Consent Mode V2 is Google's framework for adjusting how Google tags behave based on users' consent choices. It is required for organizations using Google Ads, Google Analytics 4, or other Google services that rely on consent signals — particularly for retaining access to modeled conversion data and audience features. Your DPO advises on correct CMP integration to ensure consent signals are passed accurately to Google's services.
How often should cookie audits be conducted?
Cookie scans should be conducted regularly — at minimum quarterly — and triggered automatically whenever significant website changes are made, new third-party scripts are added, or CMS or tag manager configurations change. Your DPO reviews scan results and advises on any reclassification or policy updates required.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# Annual GDPR Compliance Audit – Scope, Process, Ratings, and How Your DPO Manages the Review
URL: https://support.secureprivacy.ai/article/annual-dpo-compliance-audit-what-is-covered
Product: DPO as a Service
Category: DPO Operations
Published: 2026-03-09T20:29:00+00:00
Updated: 2026-03-22T00:57:44.023+00:00
Reading Time: 4 minutes
Summary: Learn how Secure Privacy's DPO conducts your annual GDPR compliance audit — covering governance, security, third parties, DSARs, training, and records across an eight-stage process.
The annual GDPR compliance audit is a comprehensive review conducted by your Secure Privacy DPO to assess your organization's overall data protection posture. It evaluates existing practices against GDPR legal requirements, identifies compliance gaps, classifies findings by severity, and sets remediation priorities for the year ahead — providing documented evidence of your organization's accountability obligations under GDPR Article 5(2).
Who Is This For?
- Data Protection Officers and privacy managers responsible for annual GDPR compliance reviews
- Senior leadership and board members receiving audit findings and remediation plans
- Legal and compliance teams managing data protection governance and policy frameworks
- IT, HR, and operational teams whose processes and records are in scope for the audit
Purpose of the Annual GDPR Compliance Audit
The annual compliance audit is a structured, evidence-based assessment of how effectively your organization meets its GDPR obligations across governance, processing activities, security, third-party management, and staff awareness. Conducted by your Secure Privacy DPO, the audit produces a formal report with prioritized recommendations and a tracked remediation action plan — creating an auditable record that can be presented to supervisory authorities as evidence of proactive compliance management.
GDPR Annual Compliance Audit Scope
The annual audit covers eight core areas of data protection compliance:
Area
What Is Reviewed
Governance
Data protection policies, DPO role effectiveness, organizational structure, and accountability measures
Lawful Processing
Lawful bases for all processing activities, consent management practices, and legitimate interest assessments
Data Subject Rights
DSAR processes, response times, quality of responses, and complaint handling procedures
Data Security
Technical security measures, access controls, encryption standards, and incident response procedures
Third Parties
Vendor register completeness, Data Processing Agreements, subprocessor management, and international transfer mechanisms
Records
Accuracy of the Record of Processing Activities (ROPA), breach register, DPIA register, and staff training records
Transparency
Privacy notices, cookie policies, employee privacy notices, and fair processing information provided to data subjects
Training
Staff awareness levels, training completion rates, and knowledge assessment results across all employee levels
Data Protection Audit Process: Step-by-Step
Your Secure Privacy DPO follows a structured eight-stage audit process from planning through to remediation tracking:
- Planning: Define the audit scope, schedule, and key stakeholders across the organization.
- Evidence gathering: Collect and review relevant documentation and interview key personnel in each audit area.
- Assessment: Evaluate actual practices against GDPR requirements, organizational policies, and documented procedures.
- Findings: Document all findings, classify each by severity, and identify root causes where gaps exist.
- Recommendations: Provide prioritized, actionable recommendations for remediation of identified compliance gaps.
- Report: Deliver a comprehensive audit report to senior management, including an executive summary and detailed findings by area.
- Action plan: Work with your team to develop a realistic remediation action plan with assigned owners and target completion dates.
- Follow-up: Track remediation progress through scheduled check-ins and update the action plan as items are resolved.
GDPR Audit Compliance Ratings
Each audit area is assigned a compliance rating based on the findings. Ratings determine the urgency of remediation and the priority assigned in the action plan:
Rating
Description
Action Required
Compliant
Meets all GDPR requirements with no significant issues identified
Maintain current practices; review at next annual audit
Substantially Compliant
Minor improvements needed; no material compliance risk at present
Address improvements within standard planning cycle
Partially Compliant
Significant gaps identified that require attention within a defined timeframe
Remediation plan required with assigned owners and deadlines
Non-Compliant
Critical compliance failures requiring immediate intervention
Immediate remediation required; escalate to senior leadership
Frequently Asked Questions
How is the annual GDPR compliance audit different from a DPIA?
A DPIA (Data Protection Impact Assessment) is a targeted assessment of the risks associated with a specific data processing activity, required under GDPR Article 35. The annual compliance audit is a broader, organization-wide review covering all areas of GDPR compliance — governance, security, third parties, records, training, and more. Both are part of a complete GDPR compliance program.
Is a GDPR compliance audit legally required?
GDPR does not prescribe a mandatory annual audit format, but the accountability principle under Article 5(2) requires organizations to demonstrate ongoing compliance. Supervisory authorities expect organizations to conduct regular compliance reviews and maintain documented evidence of their data protection practices. An annual audit conducted by a qualified DPO is a widely recognized way to satisfy this obligation.
Who receives the audit report?
The comprehensive audit report is delivered to senior management and, where relevant, to board-level stakeholders. The DPO also presents key findings and the remediation action plan in a scheduled leadership review meeting. A summary version may be prepared for board reporting purposes.
What happens after a non-compliant finding?
Non-compliant findings are escalated to senior leadership and trigger an immediate remediation requirement. Your DPO works with the relevant teams to define specific corrective actions, assign owners, set deadlines, and track progress through the remediation action plan. Unresolved critical findings are flagged in subsequent compliance reports until resolved.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# GDPR Data Retention Policy – Storage Limitation Principle, Retention Schedules, and DPO Oversight
URL: https://support.secureprivacy.ai/article/data-retention-policies-dpo-guidance
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T20:29:00+00:00
Updated: 2026-03-22T01:18:05.705+00:00
Reading Time: 6 minutes
Summary: Learn how Secure Privacy's DPO builds and enforces GDPR-compliant data retention policies — covering Article 5(1)(e) storage limitation, common retention periods, deletion controls, and audit oversight.
The GDPR storage limitation principle under Article 5(1)(e) requires that personal data is kept no longer than necessary for the purposes for which it is processed. Organizations that retain personal data beyond its legitimate retention period are in direct violation of GDPR — regardless of how securely the data is stored. Your Secure Privacy DPO helps define, implement, and monitor a comprehensive data retention policy that satisfies GDPR's storage limitation requirement while accounting for legal, regulatory, and operational retention obligations.
Who Is This For?
- Data Protection Officers and privacy managers responsible for GDPR Article 5(1)(e) storage limitation compliance
- Legal and compliance teams building or auditing organizational data retention schedules
- IT and systems administrators configuring automated deletion and archiving processes
- HR, finance, and marketing teams managing personal data with legally mandated or business-defined retention periods
Why GDPR Data Retention Compliance Matters
Retaining personal data longer than necessary is one of the most common GDPR compliance failures — and one of the most straightforward for supervisory authorities to identify. Beyond the regulatory risk, unnecessary data retention increases the organization's exposure in the event of a data breach, as data that has not been deleted cannot be compromised. A well-defined and actively enforced data retention policy reduces compliance risk, limits breach exposure, and demonstrates GDPR accountability under Article 5(2).
Building a GDPR-Compliant Data Retention Schedule
Your DPO works with your teams across the organization to create a comprehensive, documented retention schedule covering all categories of personal data:
- Inventory all categories of personal data processed: Identify every type of personal data held across systems, databases, archives, and third-party processors.
- Identify the lawful basis and purpose for each processing activity: Retention periods must be tied to the specific purpose for which data was collected — data cannot be retained simply because it may be useful in future.
- Determine the minimum retention period necessary: For each data category and purpose, establish the shortest retention period that satisfies operational, contractual, and legal requirements.
- Account for legal or regulatory retention obligations: Certain data categories are subject to mandatory minimum retention periods under employment law, tax regulations, financial services rules, or other applicable legislation.
- Define secure deletion or anonymization procedures: Establish how data will be destroyed or irreversibly anonymized at the end of its retention period — including procedures for backups and archived copies.
- Document the rationale for each retention period: Every retention period must be justified and recorded in the ROPA, providing a defensible audit trail for supervisory authority review.
Common GDPR Retention Period Requirements by Data Category
Retention periods vary by data type and applicable legal obligations. The following table provides indicative retention periods for common data categories — your DPO will tailor these to your organization's specific legal obligations and jurisdiction:
Data Category
Typical Retention Period
Basis
Employee records
Duration of employment + 6–7 years
Employment law, tax obligations, limitation periods
Customer transaction data
Duration of contract + 6 years
Contractual claims limitation period
Marketing consent records
Duration of consent + 1 year
Accountability obligations; evidence of valid consent
CCTV footage
30 days (unless an incident has been recorded)
Security purposes; proportionality requirement
Website cookies and analytics data
As specified in cookie policy and consent
Consent duration; purpose limitation
Job applicant data
6–12 months after recruitment process ends
Discrimination claims limitation period
Implementing Data Retention Controls
Automated deletion schedules
Configure automated deletion or archiving processes in key systems — including CRM, HR platforms, email systems, and databases — to enforce retention periods without relying on manual intervention.
Retention tags and metadata
Apply retention tags or metadata to stored records at the point of creation or ingestion, enabling systems to identify and action data at the end of its retention period reliably.
Periodic retention reviews
Conduct scheduled reviews to identify personal data that has passed its retention period and has not been automatically deleted — particularly in legacy systems, shared drives, and unstructured data stores.
Legal hold procedures
Establish documented legal hold procedures for data subject to active litigation, regulatory investigation, or other legal proceedings — suspending standard deletion schedules for the duration of the hold and resuming them upon resolution.
Staff training on retention obligations
Ensure staff in data-handling roles understand their responsibilities under the organization's retention policy, including how to apply retention schedules, recognize when data should be deleted, and escalate exceptions to the DPO.
DPO Oversight of Data Retention Compliance
Your Secure Privacy DPO monitors retention compliance through regular audits covering both automated deletion processes and manual data management practices. Audit findings are documented and addressed through the compliance reporting cycle — with any deviations from the retention schedule investigated, remediated, and recorded as part of the organization's GDPR accountability documentation under Article 5(2).
Where retention periods need to be revised — due to changes in applicable law, processing purposes, or regulatory guidance — your DPO updates the retention schedule and ensures the ROPA and privacy notices are amended accordingly.
Frequently Asked Questions
What is the GDPR storage limitation principle?
GDPR Article 5(1)(e) requires that personal data be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it is processed. This is the storage limitation principle — one of the seven core GDPR data protection principles. It does not prescribe specific retention periods, but requires organizations to define and enforce them based on the purpose of each processing activity.
Can personal data be retained indefinitely if it is anonymized?
Yes. Once personal data has been irreversibly anonymized — meaning it can no longer be used to identify an individual directly or indirectly — it falls outside the scope of GDPR and is no longer subject to retention period requirements. However, the anonymization process itself must be robust and documented. Pseudonymized data, which can still be re-identified using a separate key, remains personal data and is still subject to retention obligations.
What happens when a data subject requests erasure of data that is within its retention period?
A data subject's right to erasure under GDPR Article 17 does not override legitimate retention obligations. Where data must be retained to comply with a legal obligation, to establish or defend legal claims, or for other Article 17(3) reasons, erasure can be refused — but the refusal must be communicated to the data subject with the legal basis clearly explained. Your DPO advises on the correct response to erasure requests where retention obligations apply.
Do retention periods apply to backup copies of personal data?
Yes. Backup copies are not exempt from GDPR storage limitation requirements. Organizations must ensure that personal data deleted from live systems is also deleted from backups within a defined timeframe — or that backup restoration policies prevent deleted data from being reinstated after its retention period has expired. Your DPO advises on backup retention policies and secure deletion procedures for archived data.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# How to Contact Your DPO – Communication Channels, Response Times, and Escalation Procedures with Secure Privacy
URL: https://support.secureprivacy.ai/article/how-to-contact-and-communicate-with-your-dpo
Product: DPO as a Service
Category: DPO Fundamentals
Published: 2026-03-09T20:29:00+00:00
Updated: 2026-03-22T01:29:57.463+00:00
Reading Time: 5 minutes
Summary: Learn how to reach your Secure Privacy DPO — platform, email, scheduled meetings, and emergency hotline — plus when to escalate, response times, and what regular check-ins cover.
Effective communication with your Data Protection Officer is essential for maintaining GDPR compliance and responding to data protection issues promptly. Secure Privacy provides multiple channels for reaching your assigned DPO — from the platform dashboard for tracked formal requests to an emergency hotline for data breach incidents requiring an immediate response. This guide explains which channel to use, when to contact your DPO, and how escalation works.
Who Is This For?
- Organizations subscribed to Secure Privacy's DPO as a Service who need to contact their assigned DPO
- Legal, compliance, and IT teams managing data protection queries, incidents, and vendor reviews
- HR and operations teams handling data subject requests, employee complaints, or new project approvals
- Senior leadership receiving supervisory authority communications that require immediate DPO involvement
DPO Communication Channels and Response Times
Secure Privacy provides four communication channels for reaching your DPO, each suited to different types of queries and urgency levels:
Channel
Best For
Response Time
Secure Privacy Platform
Formal requests, documentation submissions, and tracked compliance queries
Within 1 business day
Email
General data protection questions and non-urgent advisory requests
Within 1–2 business days
Scheduled Meetings
Strategic compliance reviews, project discussions, and staff training sessions
As scheduled — weekly or monthly
Emergency Hotline
Data breach incidents, urgent regulatory matters, and time-critical compliance decisions
Within 2 hours
When to Contact Your DPO
Your DPO should be involved in any situation with data protection implications — not only when a problem has already occurred. Contact your DPO whenever:
- You discover or suspect a data breach: Use the emergency hotline immediately — the GDPR 72-hour notification clock starts when you become aware of a potential breach, not when it is confirmed.
- You receive a data subject rights request: DSARs, erasure requests, and objections must be acknowledged and responded to within GDPR deadlines — involve your DPO from the point of receipt.
- You are planning a new project or system involving personal data: Privacy by Design requires DPO input at the planning stage — before development decisions are made.
- You need to engage a new vendor or data processor: Your DPO must review and approve Data Processing Agreements before any new processor accesses personal data.
- You have questions about data protection compliance: For any processing activity where the lawful basis, retention period, or compliance approach is unclear — consult your DPO before proceeding.
- You receive communication from a supervisory authority: Forward any regulatory correspondence to your DPO immediately — all supervisory authority responses should be coordinated through your DPO.
- You need to update privacy policies or notices: Changes to processing activities, new cookie deployments, or updated vendor arrangements may require privacy notice amendments — your DPO should review before publication.
- An employee has a data protection concern or complaint: Employee complaints about data handling or privacy violations should be escalated to your DPO for assessment and response.
DPO Escalation Procedures
Use the correct escalation path based on the urgency and nature of your query:
- Standard queries: Submit through the Secure Privacy platform or by email for routine compliance questions, policy reviews, and non-urgent advisory matters. Response within 1–2 business days.
- Urgent matters: Send directly to your DPO by email with "URGENT" clearly marked in the subject line for time-sensitive compliance questions that cannot wait for a standard response cycle.
- Breach incidents: Call the emergency hotline immediately — do not wait for business hours. The GDPR 72-hour notification window begins on awareness, and early DPO involvement is critical to a compliant response.
- Supervisory authority correspondence: Forward any communication received from a supervisory authority to your DPO without delay. All regulatory responses must be coordinated through your DPO to ensure accuracy and legal compliance.
Regular DPO Check-in Meetings
In addition to reactive communication, your DPO schedules regular check-in meetings to maintain proactive oversight of your compliance program:
Open compliance action review
Each check-in includes a structured review of outstanding compliance actions from the roadmap and previous meetings — tracking progress, updating priorities, and identifying any items that have become blocked or overdue.
Upcoming project and change review
Your DPO reviews any new projects, system changes, or operational developments in the pipeline that may have data protection implications — ensuring Privacy by Design input is provided before decisions are finalized.
Regulatory updates and guidance
Your DPO provides updates on relevant regulatory developments — including new supervisory authority guidance, enforcement decisions, and changes to applicable data protection law — and advises on any action your organization needs to take in response.
Team questions and concerns
Check-in meetings provide a structured opportunity for your teams to raise data protection questions, report potential issues, and seek clarity on compliance obligations — maintaining an open channel between your organization and your DPO.
Frequently Asked Questions
What counts as an emergency requiring the hotline rather than email?
Use the emergency hotline for any situation where a delay in DPO involvement could cause your organization to miss a legal deadline or worsen a compliance exposure. This includes suspected or confirmed data breaches (where the 72-hour GDPR notification clock is running), receipt of urgent regulatory correspondence with a short response deadline, and any situation involving imminent or active unauthorized access to personal data.
Can employees contact the DPO directly, or must all contact go through a designated internal contact?
GDPR Article 38(4) requires the DPO to be accessible to data subjects — which includes your employees in their capacity as data subjects. Employees can contact your DPO directly with data protection concerns or to exercise their own data subject rights. For operational compliance queries, your organization may designate an internal privacy coordinator as a first point of contact, with escalation to the DPO as needed.
What should I do if I receive a supervisory authority letter outside business hours?
Use the emergency hotline if the correspondence indicates an immediate deadline or requires urgent action — for example, a request for information with a short response window or an enforcement notice. For standard supervisory authority correspondence received outside hours, forward it to your DPO immediately on the next business day and do not respond directly until your DPO has reviewed it.
How are DPO communications and advice documented for accountability purposes?
All formal requests submitted through the Secure Privacy platform are automatically logged and tracked — creating an auditable record of compliance queries, DPO advice, and actions taken. This documentation is part of your organization's GDPR accountability record and can be produced for supervisory authority review if needed.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# Privacy by Design and Data Protection by Default – GDPR Article 25 Requirements and How Your DPO Applies Them
URL: https://support.secureprivacy.ai/article/privacy-by-design-how-your-dpo-integrates-data-protection
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T20:28:00+00:00
Updated: 2026-03-22T01:09:11.771+00:00
Reading Time: 5 minutes
Summary: Learn what GDPR Article 25 requires for Privacy by Design and data protection by default, the seven foundational principles, and how your Secure Privacy DPO applies them across every project phase.
Privacy by Design (PbD) is a legal obligation under GDPR Article 25, requiring organizations to integrate data protection into the design of systems, processes, and products from the outset — not as an afterthought. Article 25 also requires data protection by default, meaning that only the minimum necessary personal data is processed unless the individual actively chooses otherwise. Your Secure Privacy DPO ensures both principles are applied consistently across every new project, product, and system your organization develops or deploys.
Who Is This For?
- Data Protection Officers and privacy managers responsible for GDPR Article 25 compliance
- Product managers and developers building systems or features that involve personal data processing
- IT and security teams designing access controls, retention policies, and data minimization measures
- Legal and compliance teams reviewing new projects for GDPR privacy requirements before launch
What Is Privacy by Design Under GDPR Article 25?
Privacy by Design is the principle that data protection must be embedded into the architecture of systems and processes from the earliest stage of design — not retrofitted after development is complete. GDPR Article 25(1) makes this a legal requirement, obligating controllers to implement appropriate technical and organizational measures both at the time of design and throughout the processing lifecycle. Organizations that launch data processing systems without a documented Privacy by Design approach risk regulatory enforcement and are unable to demonstrate GDPR accountability under Article 5(2).
The Seven Foundational Principles of Privacy by Design
Privacy by Design is built on seven foundational principles, each of which your DPO applies when reviewing new projects and systems:
- Proactive, not reactive: Anticipate and prevent privacy-invasive events before they occur — rather than addressing them after a breach or complaint has happened.
- Privacy as the default setting: Ensure personal data is automatically protected in any given system or process, without requiring any action from the individual.
- Privacy embedded into design: Build data protection into the architecture and design of IT systems and business practices — not bolted on as a separate layer.
- Full functionality — positive-sum, not zero-sum: Accommodate all legitimate interests without unnecessary trade-offs, demonstrating that privacy and functionality are not mutually exclusive.
- End-to-end security — lifecycle protection: Protect personal data securely throughout its complete lifecycle, from collection through to secure deletion.
- Visibility and transparency: Keep processing operations open and transparent to individuals and verifiable by supervisory authorities.
- Respect for user privacy: Keep the interests, needs, and rights of the individual at the center of system design and processing decisions.
DPO Project Privacy Review: Privacy by Design in Practice
When your organization launches a new project, product, or system involving personal data, your Secure Privacy DPO provides structured privacy input at every phase of the project lifecycle:
Project Phase
DPO Input
Planning
Privacy requirements gathering, DPIA screening, lawful basis identification
Design
Data minimization review, retention planning, access control design, consent mechanism design
Development
Security measure validation, privacy notice drafting, DPA review for new vendors
Testing
Privacy testing checklist review, data protection verification before go-live
Launch
Final compliance sign-off and monitoring plan establishment
Operation
Ongoing compliance monitoring and periodic Privacy by Design reviews
GDPR Data Protection by Default: Default Settings Review
GDPR Article 25(2) requires that, by default, only personal data that is necessary for each specific processing purpose is collected, retained, and made accessible. Your DPO reviews the default settings of every new system or product to verify compliance with this requirement:
- Only the minimum necessary personal data is collected by default — no optional fields are pre-populated or active
- Data sharing with third parties is opt-in rather than opt-out by default
- Retention periods are set to the minimum necessary for the stated processing purpose
- Access to personal data is restricted by default to those with a legitimate operational need
- Privacy notices are clear, accessible, and presented at the point of data collection
Any system that collects more data than necessary by default, or that shares data unless the user actively opts out, is non-compliant with Article 25(2) and requires remediation before launch.
Frequently Asked Questions
What is the difference between Privacy by Design and data protection by default?
Privacy by Design (Article 25(1)) requires data protection to be built into the design of systems and processes from the outset. Data protection by default (Article 25(2)) is a more specific obligation requiring that systems are configured to process only the minimum necessary personal data by default — without any action required from the individual. Both obligations apply simultaneously to all new systems and processing activities.
Does Privacy by Design apply to existing systems or only new ones?
GDPR Article 25 applies to processing activities both at the time of design and throughout the processing lifecycle. While the obligation is most clearly triggered at the design stage of new systems, organizations are also expected to review and remediate existing systems where privacy protections fall below the required standard — particularly when processing activities are significantly changed or expanded.
When should a DPIA be conducted in relation to a Privacy by Design review?
A DPIA should be initiated at the planning stage — as early in the project lifecycle as possible — before significant design decisions have been made. This allows the DPIA findings to inform design choices, rather than requiring costly changes after development is complete. Your DPO conducts a DPIA screening assessment at the planning phase to determine whether a full DPIA is required.
What happens if a product is launched without a Privacy by Design review?
Launching a system that processes personal data without implementing Privacy by Design and data protection by default measures is a direct violation of GDPR Article 25 and can result in enforcement action. It also creates downstream compliance risk — including potential DPIA obligations, breach exposure, and the cost of retrofitting privacy controls after launch. Your DPO's involvement at the planning stage prevents these risks before they materialize.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# DPO as Supervisory Authority Contact – GDPR Article 39 Regulatory Liaison, Prior Consultation, and Investigation Preparedness
URL: https://support.secureprivacy.ai/article/dpo-communication-with-supervisory-authorities
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T20:28:00+00:00
Updated: 2026-03-22T01:06:57.571+00:00
Reading Time: 5 minutes
Summary: Learn how Secure Privacy's DPO manages GDPR supervisory authority interactions — covering breach notification, Article 36 prior consultation, regulatory investigations, and complaint handling.
Under GDPR Article 39(1)(d-e), the Data Protection Officer (DPO) is designated as the official contact point between your organization and the supervisory authority. This covers everything from DPO registration and data breach notification to managing regulatory investigations and coordinating prior consultation under Article 36. Your Secure Privacy DPO handles all supervisory authority interactions on your organization's behalf — maintaining a constructive regulatory relationship and ensuring your organization responds effectively to any inquiry, complaint, or investigation.
Who Is This For?
- Data Protection Officers and privacy managers responsible for supervisory authority communications
- Legal and compliance teams preparing for or responding to regulatory investigations or inquiries
- Senior leadership seeking assurance that regulatory relationships are managed proactively
- Organizations subject to GDPR that have received or anticipate complaints, breach notifications, or authority inquiries
The DPO as GDPR Supervisory Authority Contact Point
GDPR Article 39(1)(d-e) establishes two specific DPO obligations: acting as the contact point for the supervisory authority, and cooperating with the authority on all processing-related matters. In practice, this means the DPO is the named individual through whom all regulatory communications flow — from routine registration and information requests through to formal investigations and enforcement proceedings.
Types of GDPR Supervisory Authority Interactions
Your Secure Privacy DPO manages the full range of regulatory interactions on your organization's behalf:
Interaction Type
Description
DPO Role
Registration
DPO contact details registered with the supervisory authority as required under GDPR Article 37(7)
Primary named contact point for all regulatory communications
Breach Notification
Mandatory notification to the supervisory authority within 72 hours of a qualifying personal data breach
Prepares and submits the notification; manages follow-up correspondence
Prior Consultation
Required when a DPIA indicates high residual risk that cannot be sufficiently mitigated (GDPR Article 36)
Coordinates the consultation process and implements authority recommendations
Complaints
Supervisory authority forwards data subject complaints to the organization for response
Manages the response process and works toward resolution
Investigations
Supervisory authority conducts a formal investigation or compliance audit of the organization
Coordinates the organizational response and manages document production
Inquiries
General questions or information requests from the authority on processing activities or compliance practices
Responds formally on behalf of the organization within required timeframes
GDPR Article 36 Prior Consultation Process
When a DPIA reveals that processing would result in a high residual risk that cannot be sufficiently mitigated by the organization alone, GDPR Article 36 requires prior consultation with the supervisory authority before processing begins. Your DPO manages this process end-to-end:
- Compile the DPIA and supporting documentation required by the supervisory authority under Article 36(3).
- Prepare a summary of the proposed processing activity, identified risks, and mitigation measures already implemented or planned.
- Submit the consultation request to the relevant supervisory authority in the correct format and through the correct channel.
- Manage communications during the consultation period — supervisory authorities have up to 8 weeks to respond, extendable by a further 6 weeks for complex cases.
- Implement any conditions or recommendations provided by the authority before the processing activity commences.
Regulatory Investigation Preparedness
Your DPO ensures your organization is in a state of continuous investigation readiness — so that if a supervisory authority initiates an inquiry or formal investigation, your organization can respond promptly and confidently.
Maintaining organized compliance documentation
All compliance records — including the ROPA, DPIA register, breach register, and training records — are maintained in an organized, accessible format through the Secure Privacy governance platform, ready for production on request.
Keeping the ROPA and breach register current
Your DPO ensures Records of Processing Activities and breach registers are accurate and up to date at all times — two of the first documents a supervisory authority will request during an investigation.
Maintaining DSAR records
All data subject requests and their outcomes are documented and retained, providing evidence that your organization handles individual rights requests in compliance with GDPR deadlines and requirements.
Establishing an internal regulatory response protocol
Your DPO defines and maintains a clear internal protocol for handling authority requests — including escalation paths, response timelines, and document review procedures — so your organization is never caught unprepared.
Conducting regular compliance self-assessments
Proactive self-assessments identify and address compliance gaps before they become findings in a regulatory investigation — reducing enforcement risk and demonstrating good faith accountability to the authority.
Frequently Asked Questions
What does the supervisory authority do with a registered DPO's contact details?
Under GDPR Article 37(7), organizations must publish their DPO's contact details and communicate them to the relevant supervisory authority. The authority uses these details to direct all formal regulatory communications — including breach notifications, complaints, inquiries, and investigation notices — to the correct point of contact within your organization.
What triggers a prior consultation under GDPR Article 36?
Prior consultation is required when a completed DPIA indicates that the processing would result in a high residual risk to individuals' rights and freedoms, and the organization cannot implement sufficient measures to reduce that risk to an acceptable level. Your DPO assesses this threshold as part of the DPIA sign-off process and initiates consultation where required.
How long does the GDPR prior consultation process take?
Supervisory authorities have up to 8 weeks from receipt of a prior consultation request to provide written advice. This period can be extended by a further 6 weeks for particularly complex cases, with the organization notified of the extension within the initial 8-week window. Processing must not begin until the authority's response has been received and any conditions addressed.
What should an organization do when it receives a regulatory investigation notice?
Do not respond directly without involving your DPO. Your Secure Privacy DPO will review the scope of the investigation, coordinate the collection and review of relevant documentation, prepare formal responses, and manage all communications with the authority — ensuring your organization's response is accurate, legally appropriate, and submitted within required timeframes.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# GDPR Vendor Compliance – Article 28 DPA Requirements, Risk Assessment, and International Data Transfers
URL: https://support.secureprivacy.ai/article/how-your-dpo-manages-third-party-vendor-compliance
Product: DPO as a Service
Category: DPO Operations
Published: 2026-03-09T20:28:00+00:00
Updated: 2026-03-22T00:53:50.261+00:00
Reading Time: 5 minutes
Summary: Learn how Secure Privacy's DPO manages GDPR vendor compliance — covering Article 28 DPA requirements, third-party risk assessment, and international data transfer obligations.
Under GDPR Article 28, organizations that share personal data with third-party vendors must ensure those vendors provide sufficient data protection guarantees — and must document those guarantees in a formal Data Processing Agreement (DPA). As the data controller, your organization remains legally responsible for how processors handle personal data. Your Secure Privacy DPO manages your vendor compliance framework from initial due diligence through ongoing monitoring and contract review.
Who Is This For?
- Data Protection Officers and privacy managers responsible for third-party data processor compliance
- Legal and procurement teams reviewing vendor contracts and Data Processing Agreements
- IT and security teams assessing the data protection practices of software and service vendors
- Organizations subject to GDPR that share personal data with third-party processors or subprocessors
Why GDPR Vendor Compliance Matters
When your organization shares personal data with third parties, you remain fully responsible for ensuring that data is protected in line with GDPR. Selecting a processor without adequate data protection guarantees — or without a compliant DPA in place — exposes your organization to regulatory enforcement action under GDPR Article 28, regardless of whether the breach originates with the vendor.
Third-Party Vendor Assessment Process
Your Secure Privacy DPO conducts vendor assessments through a structured five-stage process:
- Vendor inventory: Maintain a complete register of all third parties with access to personal data, including subprocessors.
- Risk classification: Categorize vendors by the type, sensitivity, and volume of personal data they process.
- Due diligence: Assess each vendor's data protection practices, security certifications (e.g., ISO 27001, SOC 2), and compliance track record.
- Contract review: Ensure all Data Processing Agreements contain the mandatory clauses required under GDPR Article 28(3).
- Ongoing monitoring: Conduct regular vendor reassessments based on risk classification to maintain continuous compliance oversight.
GDPR Article 28(3) DPA Requirements: Required Clauses
Every Data Processing Agreement must satisfy the minimum content requirements set out in GDPR Article 28(3). Your DPO reviews all vendor DPAs to confirm the following clauses are present and enforceable:
- Subject matter, duration, nature, and purpose of the processing
- Type of personal data being processed and categories of data subjects affected
- Obligations and rights of the data controller
- Requirement to process data only on documented instructions from the controller
- Confidentiality obligations for all persons authorized to process the data
- Appropriate technical and organizational security measures under GDPR Article 32
- Conditions and controls for engaging subprocessors
- Assistance obligations for responding to data subject rights requests
- Assistance with data breach notification and DPIA obligations
- Deletion or return of all personal data upon contract termination
- Audit rights for the controller and cooperation with supervisory authorities
Vendor Risk Categories and Review Frequency
Your DPO assigns each vendor a risk classification based on the nature and volume of data they process. Review frequency is determined by risk level:
Risk Level
Criteria
Review Frequency
High
Processes large volumes of personal or sensitive data; transfers data internationally
Quarterly
Medium
Regular access to personal data as part of standard service delivery
Semi-annually
Low
Limited or occasional access to personal data with minimal processing scope
Annually
International Data Transfers and GDPR Chapter V Compliance
When vendors process or transfer personal data outside the European Economic Area (EEA), additional compliance obligations apply under GDPR Chapter V. Your DPO ensures that all international data transfers by third-party vendors are covered by an appropriate transfer mechanism, including:
- Standard Contractual Clauses (SCCs) — the most commonly used mechanism for transfers to third countries without an adequacy decision
- Adequacy decisions — applicable where the European Commission has determined that the destination country provides an equivalent level of data protection
- Other approved transfer mechanisms under GDPR Article 46, such as binding corporate rules or approved codes of conduct
Your DPO reviews transfer impact assessments where required and advises on supplementary measures when SCCs alone may not be sufficient to protect transferred data.
Frequently Asked Questions
What is a Data Processing Agreement and when is it required?
A Data Processing Agreement (DPA) is a legally binding contract between a data controller and a data processor, required under GDPR Article 28 whenever a third party processes personal data on your behalf. It must be in place before any processing begins and must contain all clauses specified in Article 28(3).
What is the difference between a data processor and a data controller under GDPR?
A data controller determines the purposes and means of processing personal data. A data processor processes personal data on behalf of the controller, following the controller's instructions. Under GDPR, controllers remain responsible for ensuring their processors comply with the regulation — including through a compliant DPA.
What happens if a vendor subcontracts processing to another party?
Under GDPR Article 28(2), processors must obtain prior written authorization from the controller before engaging subprocessors. Any subprocessor must be bound by the same data protection obligations as the primary processor. Your DPO reviews subprocessor arrangements as part of the vendor due diligence process.
Are Standard Contractual Clauses still valid for international data transfers after Schrems II?
Yes, but with additional requirements. Following the Court of Justice of the EU's Schrems II ruling, organizations must conduct a transfer impact assessment to verify that SCCs provide effective protection in the destination country. Where they do not, supplementary technical or contractual measures must be applied. Your DPO advises on this assessment for all relevant vendor transfers.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# GDPR Staff Data Protection Training – Program Structure, Topics, and Compliance Tracking with Secure Privacy
URL: https://support.secureprivacy.ai/article/dpo-staff-training-and-awareness-programs
Product: DPO as a Service
Category: DPO Operations
Published: 2026-03-09T20:28:00+00:00
Updated: 2026-03-22T00:55:55.526+00:00
Reading Time: 4 minutes
Summary: Learn how Secure Privacy's DPO delivers GDPR staff data protection training — covering all employee levels, training topics, delivery methods, and completion tracking for regulatory accountability.
Human error remains one of the leading causes of personal data breaches. GDPR Article 39(1)(b) explicitly requires the DPO to monitor staff compliance with data protection obligations — including ensuring that employees receive adequate, role-appropriate training. Your Secure Privacy DPO designs and delivers a structured GDPR staff training program tailored to your organization, tracks completion, and reports on training metrics as part of your broader compliance accountability framework.
Who Is This For?
- Data Protection Officers and HR teams responsible for staff compliance training programs
- Legal and compliance managers demonstrating GDPR accountability to supervisory authorities
- IT, marketing, and HR teams subject to role-specific data protection training requirements
- Senior leadership and management teams with GDPR governance and breach notification responsibilities
Why GDPR Staff Data Protection Training Is Essential
Human error — including mishandled data, phishing susceptibility, and incorrect responses to data subject requests — is a primary driver of GDPR breaches. Beyond the operational risk, GDPR Article 39(1)(b) makes staff training a direct DPO obligation. Inadequate training exposes your organization to regulatory scrutiny, particularly when investigating breach incidents where employee awareness failures are a contributing factor.
GDPR Data Protection Training Program Structure
Your Secure Privacy DPO delivers a tiered training program aligned to employee roles and data protection responsibilities:
Training Level
Audience
Topics Covered
Frequency
Foundation
All employees
GDPR basics, data protection principles, recognizing personal data, reporting incidents
On hire + annually
Role-Specific
Teams handling personal data
Lawful bases, data minimization, retention schedules, data subject rights, secure data handling
Annually
Management
Senior leadership
Accountability obligations, risk management, breach notification duties, governance responsibilities
Annually
Specialist
IT, HR, Marketing
Department-specific data protection requirements, tools, and operational processes
As needed
Staff Data Protection Training Topics
The training program covers the full range of GDPR compliance topics relevant to day-to-day staff responsibilities, grouped by theme:
GDPR Principles and Legal Foundations
- Key principles of GDPR and other applicable data protection laws
- Recognizing and correctly classifying personal and special category data
- Understanding lawful bases for processing and when each applies
Data Subject Rights and Request Handling
- The six GDPR data subject rights and organizational obligations for each
- How to recognize, log, and escalate a Data Subject Access Request (DSAR)
Breach Identification and Incident Reporting
- How to identify a potential personal data breach and what constitutes a reportable incident
- Internal reporting procedures and escalation paths to the DPO
Secure Data Handling Practices
- Secure handling, storage, and lawful disposal of personal data
- Email security and phishing awareness
- Clean desk and clear screen policies
- Social engineering awareness and prevention
Training Delivery Methods
Your Secure Privacy DPO uses a blended training approach to maximize engagement and retention across your workforce:
- Live sessions delivered by your DPO — available in-person or virtually — for foundation, management, and specialist cohorts.
- Self-paced e-learning modules for flexible completion, particularly suited to on-hire induction training and annual refreshers.
- Scenario-based workshops and tabletop exercises that simulate real data protection incidents to build practical response skills.
- Regular awareness communications — including newsletters and targeted privacy tips — to maintain ongoing data protection awareness between formal training cycles.
- Simulated phishing exercises to test and strengthen employee resilience against social engineering attacks.
Training Completion Tracking and Compliance Reporting
Training completion rates and assessment results are tracked through the Secure Privacy platform, giving your DPO a real-time view of staff compliance across your organization. Training metrics — including completion rates by department, outstanding training, and assessment outcomes — are included in regular DPO compliance reports.
This creates a documented, auditable record of your organization's staff training program, which can be presented to supervisory authorities as evidence of GDPR accountability under Article 5(2).
Frequently Asked Questions
Is GDPR staff training legally required?
GDPR does not prescribe a specific training format, but GDPR Article 39(1)(b) requires the DPO to monitor staff awareness and compliance with data protection obligations. Supervisory authorities expect organizations to demonstrate adequate staff training as part of their accountability obligations under Article 5(2). Lack of training is frequently cited as an aggravating factor in enforcement decisions.
How often should GDPR training be repeated?
Foundation and role-specific training should be conducted at hire and repeated annually. Management training is also conducted annually. Specialist training for departments such as IT, HR, and marketing is delivered as needed when processes change or new tools are introduced. Your DPO tracks completion and schedules refreshers accordingly.
What should happen if an employee fails to complete required training?
Outstanding training is flagged in the Secure Privacy platform and included in compliance reports. Your DPO advises on escalation procedures for employees who have not completed mandatory training, particularly where their role involves regular access to personal data.
Can training be used as evidence of GDPR compliance?
Yes. Documented training records — including completion rates, assessment results, and training content — are valuable evidence of organizational accountability under GDPR Article 5(2). Your DPO maintains these records and can produce them for regulatory review or audit purposes.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# GDPR International Data Transfers – Chapter V Mechanisms, Transfer Impact Assessments, and Schrems II Compliance
URL: https://support.secureprivacy.ai/article/cross-border-data-transfers-and-your-dpo
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T20:28:00+00:00
Updated: 2026-03-22T01:12:22.498+00:00
Reading Time: 6 minutes
Summary: Learn how Secure Privacy's DPO manages GDPR Chapter V international data transfers — covering SCCs, adequacy decisions, Transfer Impact Assessments, and Schrems II supplementary measures.
When personal data is transferred outside the European Economic Area (EEA), GDPR Chapter V requires organizations to ensure an adequate level of protection is maintained — through an approved transfer mechanism such as Standard Contractual Clauses (SCCs), an adequacy decision, or Binding Corporate Rules. Following the Schrems II ruling, organizations must also conduct Transfer Impact Assessments (TIAs) before transferring data to countries without an adequacy decision. Your Secure Privacy DPO maps all international transfers, identifies the correct mechanism for each, and keeps your transfer framework compliant as laws and adequacy decisions evolve.
Who Is This For?
- Data Protection Officers and privacy managers responsible for GDPR Chapter V international transfer compliance
- Legal and compliance teams reviewing vendor contracts involving personal data transfers outside the EEA
- IT and procurement teams engaging cloud providers or software vendors based in third countries
- Multinational organizations managing cross-border data flows within corporate groups or with international partners
Understanding GDPR Cross-Border Data Transfer Requirements
GDPR Chapter V restricts the transfer of personal data to countries outside the EEA unless the transfer is covered by an approved mechanism or a specific derogation applies. The core principle is that personal data transferred internationally must receive the same level of protection as it would within the EEA — regardless of where the data physically moves. Organizations that transfer personal data to third countries without an appropriate transfer mechanism in place are in direct violation of GDPR and face significant enforcement risk.
GDPR International Data Transfer Mechanisms
GDPR provides six lawful mechanisms for international data transfers. Your DPO identifies and implements the correct mechanism for each transfer activity:
Mechanism
GDPR Article
Description
Adequacy Decision
Article 45
Transfer to countries the European Commission has formally determined provide an adequate level of data protection — no additional safeguards required
Standard Contractual Clauses (SCCs)
Article 46(2)(c)
Pre-approved contractual terms between the data exporter and importer, updated by the European Commission in 2021 following Schrems II
Binding Corporate Rules (BCRs)
Article 47
Approved internal data protection rules governing transfers within a multinational corporate group — requires supervisory authority approval
Codes of Conduct
Article 46(2)(e)
Approved industry codes of conduct with binding commitments from the controller or processor in the third country
Certification Mechanisms
Article 46(2)(f)
Approved certification schemes with binding and enforceable commitments applied by the data importer
Derogations
Article 49
Limited, case-by-case exceptions for specific situations such as explicit consent, contract performance, or important public interest — not suitable for systematic or repeated transfers
Transfer Impact Assessments After Schrems II
Following the Court of Justice of the EU's Schrems II ruling (C-311/18), organizations must conduct a Transfer Impact Assessment (TIA) before transferring personal data to any country that does not benefit from an adequacy decision. The TIA evaluates whether the legal framework of the recipient country undermines the protections provided by the chosen transfer mechanism — and whether supplementary measures are needed to fill any gaps. Your DPO manages the TIA process end-to-end:
- Map all international data transfers: Identify every flow of personal data leaving the EEA, including transfers to cloud providers, software vendors, and group entities.
- Identify the transfer mechanism for each flow: Confirm which GDPR Chapter V mechanism is in place — or identify transfers that currently lack a lawful basis.
- Assess the legal framework of the recipient country: Evaluate the destination country's surveillance laws, data access rights, and rule of law — the core Schrems II assessment.
- Evaluate whether supplementary measures are needed: Determine whether the transfer mechanism alone provides effective protection, or whether additional technical, contractual, or organizational measures are required.
- Document the assessment and conclusions: Produce a written TIA record that demonstrates the organization's due diligence — essential for accountability under GDPR Article 5(2).
- Implement supplementary measures where required: Apply the identified measures before the transfer proceeds or continues.
Schrems II Supplementary Measures for International Transfers
Where a TIA reveals that a transfer mechanism alone does not provide sufficient protection, supplementary measures must be applied. Your DPO advises on the appropriate combination of measures for each transfer:
Technical measures
End-to-end encryption of data before transfer, pseudonymization to reduce re-identification risk, and split or distributed processing architectures that prevent any single importer from accessing complete personal data sets.
Contractual measures
Additional contractual obligations on the data importer — beyond the standard SCC provisions — including enhanced transparency requirements, notification obligations for government access requests, and restrictions on onward transfers to subprocessors.
Organizational measures
Internal access control policies limiting which personnel in the third country can access personal data, regular transparency reporting by the data importer on government access requests, and documented audit rights for the data exporter.
Ongoing Monitoring of International Transfer Compliance
The international transfer landscape changes frequently — adequacy decisions are adopted and challenged, SCCs are updated, and court rulings alter the risk profile of transfers to specific countries. Your DPO maintains continuous oversight of your organization's transfer framework, including:
- Tracking new and revised adequacy decisions issued by the European Commission
- Monitoring SCC updates and ensuring existing contracts are updated within required timeframes
- Following relevant court decisions and EDPB guidance that affect the validity of transfer mechanisms
- Reviewing TIAs when recipient country laws change in a way that may affect the adequacy of protections
- Updating your transfer register in the ROPA to reflect any changes to transfer mechanisms or recipients
Frequently Asked Questions
What is the difference between an adequacy decision and Standard Contractual Clauses?
An adequacy decision is a formal determination by the European Commission that a specific country provides an equivalent level of data protection to the EEA — no additional contractual safeguards are required for transfers to that country. Standard Contractual Clauses are pre-approved contractual terms that must be signed between the data exporter and importer when no adequacy decision covers the destination country. SCCs require a Transfer Impact Assessment under Schrems II; adequacy decisions do not.
Does Schrems II mean US data transfers are unlawful?
Not necessarily. The EU-US Data Privacy Framework (adopted in 2023) provides an adequacy decision for transfers to certified US organizations. Transfers to non-certified US entities still require SCCs supplemented by a Transfer Impact Assessment. Your DPO assesses the correct mechanism for each US transfer on a case-by-case basis, accounting for the recipient's certification status and the nature of the data transferred.
Are Transfer Impact Assessments required for all international transfers?
TIAs are required for transfers to countries without an adequacy decision, where SCCs or another Article 46 mechanism is being used. They are not required where the transfer is covered by an adequacy decision — though your DPO monitors the validity of adequacy decisions and will initiate a TIA if an adequacy decision is suspended or invalidated.
What should an organization do if a TIA reveals that a transfer cannot be adequately protected?
If a TIA concludes that neither the transfer mechanism nor supplementary measures can provide effective protection for the data transferred, the transfer must be suspended or terminated. Your DPO advises on alternative processing arrangements — such as migrating data to an EEA-based processor — and documents the decision and rationale for regulatory accountability purposes.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | C
---
# DPO Compliance Reporting – GDPR Reports, Key Metrics, and How Findings Are Delivered via Secure Privacy
URL: https://support.secureprivacy.ai/article/dpo-compliance-reporting-what-to-expect
Product: DPO as a Service
Category: DPO Operations
Published: 2026-03-09T20:27:00+00:00
Updated: 2026-03-22T00:46:43.646+00:00
Reading Time: 3 minutes
Summary: Learn how Secure Privacy's DPO service delivers GDPR compliance reports — monthly, quarterly, and annual — covering DSARs, breach incidents, DPIAs, and risk metrics.
The Secure Privacy DPO service includes structured GDPR compliance reporting delivered to your leadership team on a regular basis. These reports give your organization visibility into its data protection posture, track key privacy metrics, and ensure accountability under GDPR's Article 39 DPO obligations.
Who Is This For?
- Data Protection Officers and privacy managers overseeing compliance programs
- Board members and C-Suite executives receiving quarterly compliance briefings
- IT and privacy teams using operational reports to track DSARs, incidents, and audits
- Legal and compliance leads managing GDPR accountability documentation
Why GDPR Compliance Reporting Matters
Regular compliance reporting is a core element of the DPO's accountability function under GDPR. These reports give your leadership team clear visibility into the organization's data protection status, surface emerging risks, and track progress on compliance initiatives — creating an auditable record of your privacy program over time.
Types of DPO Compliance Reports
Your Secure Privacy DPO delivers the following report types:
Report Type
Frequency
Audience
Content
Executive Summary
Quarterly
Board / C-Suite
High-level compliance status, key risks, and strategic recommendations
Operational Report
Monthly
Privacy Team / IT
DSAR statistics, breach incidents, training completion rates, and audit findings
Annual Review
Annually
All Stakeholders
Comprehensive compliance assessment, year-over-year trends, and priorities for the year ahead
Ad Hoc Reports
As needed
Varies
Specific compliance questions, incident reports, and DPIA findings
Key GDPR Compliance Metrics Tracked
Each report draws on data tracked continuously through the Secure Privacy platform, including:
- Number of Data Subject Access Requests (DSARs) received and average resolution time
- Data breach incidents, notification timelines, and response effectiveness
- Staff privacy training completion rates
- DPIA completion status for new or changed processing activities
- Outstanding compliance actions and their priority level
- Regulatory changes affecting your organization's data protection obligations
- Third-party vendor and processor compliance status
How Compliance Reports Are Delivered
Reports are delivered securely through the Secure Privacy platform dashboard, with access restricted to authorized stakeholders. Your DPO also presents quarterly findings directly to your leadership team in scheduled review meetings, ensuring findings are understood and acted upon at the right level of the organization.
Acting on Compliance Report Findings
Every report includes prioritized recommendations tied to identified risks or compliance gaps. Your Secure Privacy DPO works with your team to translate findings into concrete compliance tasks, which are tracked and managed through the platform's built-in task management features — maintaining a clear record of remediation activity for audit purposes.
Frequently Asked Questions
How often does the DPO deliver compliance reports?
Report frequency depends on the report type. Operational reports are delivered monthly, executive summaries quarterly, and a full annual review is conducted once per year. Ad hoc reports can be requested as needed for specific compliance events or incidents.
Who has access to the compliance reports?
Reports are accessible through the Secure Privacy platform dashboard to authorized stakeholders only. Access levels are role-based — executive summaries are typically scoped to board and C-Suite audiences, while operational reports are available to privacy and IT teams.
What happens after a high-risk finding is identified in a report?
High-risk findings are accompanied by prioritized recommendations. Your DPO works with your team to define remediation actions, which are tracked through the platform. For critical risks, escalation to leadership is part of the standard reporting process.
Does the DPO reporting service cover DPIA requirements?
Yes. DPIA completion status is tracked as part of the operational reporting cycle, and DPIA findings can be issued as ad hoc reports when a specific processing activity requires assessment under GDPR Article 35.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# GDPR Data Breach Response – 72-Hour Notification Requirements and How Your DPO Manages the Process
URL: https://support.secureprivacy.ai/article/how-your-dpo-handles-data-breach-notifications
Product: DPO as a Service
Category: DPO Operations
Published: 2026-03-09T20:27:00+00:00
Updated: 2026-03-22T00:52:07.167+00:00
Reading Time: 5 minutes
Summary: Learn how Secure Privacy's DPO manages GDPR data breach response — covering the 72-hour notification deadline, risk assessment, supervisory authority reporting, and breach register maintenance.
Under GDPR Article 33, organizations must notify their supervisory authority of a personal data breach within 72 hours of becoming aware of it. When a breach affects individuals at high risk, data subject notification is also required without undue delay. Your Secure Privacy DPO manages the full breach response process — from initial triage and risk assessment through supervisory authority notification, data subject communications, and post-breach review.
Who Is This For?
- Data Protection Officers and privacy managers responsible for breach response under GDPR
- IT and security teams identifying and containing data security incidents
- Legal and compliance teams managing notification obligations to supervisory authorities
- Organizations subject to GDPR that handle personal data and need a structured breach response process
The DPO's Role in GDPR Data Breach Response
When a personal data breach occurs, time is critical. Your Secure Privacy DPO plays a central role in ensuring your organization identifies the breach correctly, assesses its severity, meets all notification deadlines, and documents the incident in line with GDPR Article 33(5) requirements.
Data Breach Assessment Process
When a potential breach is reported, your Secure Privacy DPO follows a structured five-stage assessment:
- Initial triage: Determine whether a personal data breach has occurred as defined under GDPR Article 4(12).
- Risk assessment: Evaluate the likelihood and severity of risk to the rights and freedoms of affected individuals.
- Scope determination: Identify the categories and approximate number of data subjects and records affected.
- Containment advice: Recommend immediate technical and organizational measures to contain and limit the breach.
- Notification decision: Determine whether notification to the supervisory authority and/or affected data subjects is required under GDPR Articles 33 and 34.
GDPR 72-Hour Breach Notification Requirements
GDPR sets different notification obligations depending on the risk level of the breach. The table below summarizes each notification type, when it is triggered, the applicable deadline, and required content.
Notification Type
Trigger
Deadline
Required Contents
Supervisory Authority (Article 33)
Breach likely to result in risk to individuals' rights and freedoms
72 hours from awareness
Nature of breach, categories and numbers affected, likely consequences, measures taken or proposed
Data Subjects (Article 34)
Breach likely to result in high risk to individuals' rights and freedoms
Without undue delay
Plain language description of the breach, DPO contact details, likely consequences, measures taken and recommended to affected individuals
No Notification Required
Breach unlikely to result in risk to individuals
N/A
Document in internal breach register only — no external notification required
What Your Secure Privacy DPO Provides During a Data Breach
Expert notification assessment
Your DPO assesses notification obligations across all applicable jurisdictions — including requirements beyond GDPR where relevant — ensuring your organization meets every applicable deadline.
Supervisory authority notification drafting
Your DPO drafts the formal notification to the relevant supervisory authority, ensuring it meets the minimum content requirements under GDPR Article 33(3).
Data subject communication drafting
Where individual notification is required under Article 34, your DPO prepares clear, plain-language communications for affected data subjects.
Containment and remediation guidance
Your DPO advises on immediate technical and organizational measures to contain the breach and reduce further exposure, working alongside your IT and security teams.
Breach register documentation
Your DPO ensures every incident is fully documented in your internal breach register, regardless of whether external notification is required.
Post-breach review
After the immediate response, your DPO conducts a structured post-breach review to identify root causes and recommend measures to prevent recurrence.
GDPR Breach Register: Article 33(5) Requirements
Regardless of whether supervisory authority notification is required, GDPR Article 33(5) mandates that all personal data breaches be documented internally. Your Secure Privacy DPO maintains a comprehensive breach register that records:
- The facts of each breach, including date, nature, and scope
- The effects and likely consequences for affected individuals
- The remedial actions taken and any notification decisions made
- The rationale for decisions not to notify where notification thresholds were not met
This register provides your organization with a complete, audit-ready record of all breach incidents for regulatory review.
Frequently Asked Questions
What is the GDPR 72-hour breach notification deadline?
Under GDPR Article 33, organizations must notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach — provided the breach is likely to result in a risk to individuals' rights and freedoms. If notification cannot be made within 72 hours, it must be accompanied by reasons for the delay.
Do all data breaches need to be reported to the supervisory authority?
No. Notification to the supervisory authority is only required when the breach is likely to result in a risk to individuals' rights and freedoms. However, all breaches — regardless of risk level — must be documented in the internal breach register under Article 33(5).
When must affected individuals be notified of a data breach?
Data subjects must be notified without undue delay when a breach is likely to result in a high risk to their rights and freedoms — a higher threshold than the supervisory authority notification trigger. Your DPO assesses this threshold as part of the breach triage process.
What if a breach involves personal data processed in multiple EU member states?
Cross-border breaches may trigger notification obligations with a lead supervisory authority under GDPR's one-stop-shop mechanism, as well as obligations to other concerned supervisory authorities. Your DPO will advise on the correct notification routing for multi-jurisdictional incidents.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# GDPR Records of Processing Activities (ROPA) – Article 30 Requirements and How Your DPO Manages Them
URL: https://support.secureprivacy.ai/article/gdpr-article-30-records-of-processing-activities
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T20:27:00+00:00
Updated: 2026-03-22T01:04:27.211+00:00
Reading Time: 5 minutes
Summary: Learn what GDPR Article 30 requires for Records of Processing Activities (ROPA), who must maintain them, required contents, and how Secure Privacy's DPO keeps your ROPA audit-ready.
Under GDPR Article 30, most organizations that process personal data are required to maintain a Record of Processing Activities (ROPA). The ROPA is a foundational compliance document that maps every data processing activity your organization undertakes — capturing lawful bases, data categories, retention periods, recipients, and security measures. Your Secure Privacy DPO creates, maintains, and keeps your ROPA audit-ready as part of your ongoing GDPR compliance program.
Who Is This For?
- Data Protection Officers and privacy managers responsible for GDPR Article 30 compliance
- Legal and compliance teams building or auditing their organization's data processing inventory
- IT and operations teams supporting data mapping exercises to identify processing activities
- Organizations subject to supervisory authority inspection who need an accurate, current ROPA
What Are Records of Processing Activities (ROPA) Under GDPR?
A Record of Processing Activities (ROPA) is a structured internal register of all personal data processing activities carried out by your organization as a data controller or processor. GDPR Article 30 makes maintaining this record a legal obligation — not a best practice. The ROPA provides supervisory authorities with a clear picture of how your organization handles personal data and is a primary document requested during regulatory inspections and investigations.
Who Must Maintain a ROPA Under GDPR Article 30?
GDPR Article 30(5) provides a limited exemption for organizations with fewer than 250 employees — but this exemption is narrower than it appears. It does not apply if any of the following conditions are met:
- The processing is likely to result in a risk to the rights and freedoms of data subjects
- The processing is not occasional — meaning it occurs on a regular or ongoing basis
- The processing includes special categories of personal data (Article 9) or criminal conviction data (Article 10)
In practice, nearly all organizations that process personal data regularly — including most SMEs — must maintain a ROPA. If your organization processes employee data, customer data, or user data as a standard part of operations, the exemption almost certainly does not apply.
GDPR Article 30 Required ROPA Contents
Your ROPA must document the following information for each individual processing activity:
Field
Description
Example
Controller Details
Name and contact details of the controller, any joint controllers, and the DPO
Acme Ltd; DPO: Secure Privacy
Purposes
The specific purposes for which the personal data is processed
Employee payroll processing
Data Categories
Categories of personal data processed in the activity
Name, address, bank details, salary
Data Subject Categories
Categories of individuals whose personal data is processed
Employees, contractors
Recipients
Categories of recipients to whom personal data is disclosed
Payroll provider, tax authority
International Transfers
Details of any transfers to third countries, including the transfer mechanism or safeguards applied
US transfer under Standard Contractual Clauses (SCCs)
Retention Periods
Envisaged time limits for erasure or review of each data category
7 years after employment ends
Security Measures
A general description of the technical and organizational security measures in place
Encryption at rest and in transit, role-based access controls, audit logs
How Your Secure Privacy DPO Manages Your ROPA
Data mapping and processing activity discovery
Your DPO conducts structured data mapping exercises across your organization to identify all processing activities, data flows, and systems handling personal data — ensuring no processing activity is undocumented.
ROPA creation and structuring
Your DPO creates and maintains the ROPA in a structured, Article 30-compliant format — integrated with the Secure Privacy governance platform for centralized access and version control.
Ongoing updates when processing changes
When processing activities change — due to new products, system changes, or updated vendor relationships — your DPO reviews and updates the ROPA to keep it accurate and current.
Supervisory authority inspection readiness
GDPR Article 30(4) requires the ROPA to be made available to supervisory authorities on request. Your DPO ensures the register is maintained in a format that can be produced promptly during an inspection or investigation.
ROPA integration with the governance platform
ROPA management is integrated with the Secure Privacy governance platform, linking processing activities to associated DPIAs, vendor records, and risk assessments for a complete, cross-referenced compliance picture.
Frequently Asked Questions
What is the difference between a ROPA and a data mapping exercise?
A data mapping exercise is the process of discovering and documenting all personal data flows across your organization. The ROPA is the formal output of that exercise — a structured record of processing activities in the format required by GDPR Article 30. The data mapping feeds the ROPA, and both must be kept current as processing activities evolve.
Does GDPR require the ROPA to be in a specific format?
No. GDPR Article 30(3) requires the ROPA to be in written form, including electronic form, but does not prescribe a specific template or format. What matters is that it captures all required fields for each processing activity and can be produced for supervisory authorities on request.
How often should a ROPA be updated?
The ROPA should be treated as a living document — updated whenever a new processing activity is introduced, an existing activity changes in scope or purpose, a new vendor is engaged, or a retention period is revised. Your DPO reviews the ROPA as part of the annual compliance audit and on an ad hoc basis as changes occur.
What happens if an organization cannot produce a ROPA during a supervisory authority inspection?
Failure to maintain a ROPA when required under GDPR Article 30 is a direct compliance violation and can result in regulatory enforcement action. Supervisory authorities treat the absence of a ROPA as an indicator of broader accountability failures, which may trigger deeper investigation into the organization's data protection practices.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# What Is a DPIA? GDPR Article 35 Requirements, Process Steps, and How Your DPO Helps
URL: https://support.secureprivacy.ai/article/understanding-dpia-with-your-dpo
Product: DPO as a Service
Category: DPO Operations
Published: 2026-03-09T20:27:00+00:00
Updated: 2026-03-22T00:50:08.192+00:00
Reading Time: 4 minutes
Summary: Learn when a DPIA is required under GDPR Article 35, what it must contain, and how Secure Privacy's DPO service guides your organization through every step of the process.
A Data Protection Impact Assessment (DPIA) is a mandatory GDPR process for identifying and minimizing privacy risks before high-risk data processing activities begin. Under GDPR Article 35, organizations must complete a DPIA whenever processing is likely to result in a high risk to individuals' rights and freedoms. Your Secure Privacy DPO guides your team through every stage of the assessment — from initial screening to sign-off and ongoing review.
Who Is This For?
- Data Protection Officers and privacy managers responsible for GDPR Article 35 compliance
- Legal and compliance teams assessing new data processing activities
- IT and product teams launching projects that involve personal data processing
- Organizations subject to GDPR that process special category data or conduct large-scale profiling
What Is a Data Protection Impact Assessment (DPIA)?
A DPIA is a structured process designed to systematically analyze and minimize the data protection risks of a project or processing activity. Under GDPR Article 35, completing a DPIA is not optional — it is a legal requirement for processing activities that pose a high risk to individuals. Failing to conduct a required DPIA can result in regulatory enforcement action and significant fines.
DPIA Requirements Under GDPR: When Is One Mandatory?
A DPIA is required under GDPR Article 35 when processing is likely to result in a high risk to individuals. This includes, but is not limited to, processing that involves:
- Systematic and extensive evaluation of personal aspects through profiling, where decisions produce significant effects on individuals
- Large-scale processing of special categories of personal data (e.g., health, biometric, or criminal offense data)
- Systematic monitoring of publicly accessible areas on a large scale (e.g., CCTV)
- Any processing activity included on your supervisory authority's published list of operations requiring a DPIA
When in doubt, your DPO can conduct a pre-screening assessment to determine whether a full DPIA is needed.
The DPIA Process: Step-by-Step
Your Secure Privacy DPO guides your organization through a structured, seven-stage DPIA process:
- Screening: Determine whether a DPIA is required for the proposed processing activity.
- Description: Document the nature, scope, context, and purposes of the processing in full.
- Necessity assessment: Evaluate whether the processing is necessary and proportionate to its stated purpose.
- Risk identification: Identify specific risks to the rights and freedoms of data subjects arising from the processing.
- Risk mitigation: Define technical and organizational measures to address and reduce identified risks.
- Sign-off: The DPO provides formal written advice and the completed assessment is approved by the data controller.
- Review: Schedule ongoing reviews to keep the DPIA current as the processing activity evolves over time.
GDPR Article 35(7) DPIA Contents: What Must Be Included
GDPR Article 35(7) specifies the minimum required contents of a valid DPIA. Your Secure Privacy DPO ensures all four elements are fully addressed:
Requirement
Description
Processing Description
A systematic description of the envisaged processing operations and their purposes, including the legitimate interest pursued where applicable
Necessity Assessment
An assessment of the necessity and proportionality of the processing in relation to its purpose
Risk Assessment
An assessment of the risks to the rights and freedoms of data subjects, including likelihood and severity
Mitigation Measures
The measures envisaged to address identified risks and demonstrate GDPR compliance, including safeguards and security measures
How Your Secure Privacy DPO Supports the DPIA Process
Your Secure Privacy DPO provides expert guidance at every stage of the DPIA lifecycle. This includes reviewing completed assessments for completeness and legal sufficiency, advising on the adequacy of proposed mitigation measures, and determining whether the residual risk is acceptable for processing to proceed.
Where residual risk remains high after mitigation, your DPO will advise on whether prior consultation with the supervisory authority is required under GDPR Article 36 — a step that is mandatory if the risk cannot be sufficiently reduced by the data controller alone.
Frequently Asked Questions
What happens if an organization fails to conduct a required DPIA?
Failing to carry out a mandatory DPIA is a direct violation of GDPR Article 35 and can result in regulatory enforcement action, including fines of up to €10 million or 2% of global annual turnover under GDPR Article 83(4).
Who is responsible for approving a completed DPIA?
The data controller is responsible for approving the DPIA. The DPO provides formal written advice as part of the sign-off process but does not bear personal liability for the controller's processing decisions. Where disagreement exists, the DPO's advice and the controller's reasoning must both be documented.
Does a DPIA need to be repeated?
Yes. DPIAs are not one-time documents. GDPR requires organizations to review a DPIA when the processing activity changes or when there is reason to believe the risk level has shifted. Your DPO will help schedule and manage periodic reviews.
When is prior consultation with a supervisory authority required after a DPIA?
Under GDPR Article 36, prior consultation with the relevant supervisory authority is required when the DPIA indicates that high residual risk cannot be adequately mitigated by the organization alone. Your DPO will assess this and manage the consultation process on your behalf if needed.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# GDPR Data Subject Rights and DSAR Handling – How Your DPO Manages Requests with Secure Privacy
URL: https://support.secureprivacy.ai/article/managing-dsar-through-your-dpo
Product: DPO as a Service
Category: DPO Operations
Published: 2026-03-09T20:27:00+00:00
Updated: 2026-03-22T00:48:33.686+00:00
Reading Time: 4 minutes
Summary: Learn how Secure Privacy's DPO service handles GDPR data subject rights requests — covering all six GDPR rights, response timelines, exemptions, and DSAR best practices.
Under GDPR, individuals have the right to access, correct, delete, and restrict the use of their personal data. These requests — known as Data Subject Access Requests (DSARs) — must be handled within strict legal timeframes. Your Secure Privacy DPO ensures your organization can respond to all types of data subject rights requests correctly, on time, and with proper documentation.
Who Is This For?
- Data Protection Officers and privacy managers handling GDPR compliance
- Legal and compliance teams managing data subject rights workflows
- HR and IT teams responsible for locating and processing personal data in response to DSARs
- Organizations subject to GDPR looking to streamline their DSAR handling process
GDPR Data Subject Rights: Full Overview
GDPR grants individuals six core rights over their personal data. The table below summarizes each right, the applicable GDPR article, and what it requires of your organization.
Right
GDPR Article
Description
Right of Access
Article 15
Individuals can request a copy of their personal data and information about how it is processed
Right to Rectification
Article 16
Individuals can request correction of inaccurate or incomplete personal data
Right to Erasure
Article 17
Individuals can request deletion of their personal data in certain circumstances (the "right to be forgotten")
Right to Restriction
Article 18
Individuals can request that processing of their personal data be restricted under specific conditions
Right to Data Portability
Article 20
Individuals can receive their personal data in a structured, commonly used, machine-readable format
Right to Object
Article 21
Individuals can object to processing based on legitimate interests or for direct marketing purposes
GDPR DSAR Response Timeline
Organizations must respond to Data Subject Access Requests within one month of receipt. For complex or numerous requests, this deadline can be extended by a further two months — but the data subject must be notified of the extension within the initial one-month period, along with the reason for the delay.
How Your DPO Manages DSAR Handling
Your Secure Privacy DPO supports every stage of the DSAR response process:
- Request validation: Verify the identity of the requester and determine which data subject right applies.
- Scope assessment: Define the scope of the request and identify all relevant internal data sources.
- Exemption review: Advise on applicable exemptions under GDPR, such as legal privilege or third-party rights.
- Response preparation: Guide your team in preparing a complete, compliant response.
- Quality review: Review the final response before it is sent to the data subject to ensure accuracy and compliance.
- Documentation: Ensure the request, decision-making process, and response are fully documented for audit purposes.
DSAR Best Practices for GDPR Compliance
Acknowledge requests promptly
Send an acknowledgment as soon as a DSAR is received. This confirms receipt and starts the clock on your one-month response window.
Use a centralized DSAR tracking system
Manage all incoming requests through a single platform to avoid missed deadlines and ensure consistent handling. Secure Privacy's built-in DSAR tracking tools support this directly.
Train staff to recognize and escalate DSARs
Any employee may receive a data subject request — not just the privacy team. Ensure all staff know how to identify a DSAR and who to escalate it to immediately.
Document all refusals and exemption decisions
If a request is refused or an exemption applied, document the legal basis and reasoning clearly. This is critical for demonstrating GDPR accountability if the decision is challenged.
Track and manage all requests through Secure Privacy
Use the Secure Privacy DSAR management tools to log, assign, and track every data subject request from receipt to resolution.
Frequently Asked Questions
What is the GDPR deadline for responding to a DSAR?
Organizations must respond within one month of receiving the request. This can be extended by two further months for complex or high-volume cases, provided the data subject is informed of the extension within the initial one-month period.
Can an organization refuse a data subject request?
Yes, in certain circumstances. GDPR provides exemptions — for example, where disclosure would adversely affect the rights of third parties or where a legal privilege applies. Any refusal must be documented with the legal basis clearly stated, and the data subject must be informed of their right to complain to a supervisory authority.
What is the difference between a DSAR and a DPIA?
A DSAR (Data Subject Access Request) is a request made by an individual exercising their rights over their own personal data. A DPIA (Data Protection Impact Assessment) is an internal process carried out by an organization to assess the privacy risks of a specific data processing activity before it begins.
How does Secure Privacy help manage GDPR data subject requests?
Secure Privacy provides built-in DSAR forms, request tracking, and workflow tools to help organizations handle data subject rights requests on time and with a complete audit trail. Your DPO also provides direct support at each stage of the response process.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# DPO as a Service – What It Is, Who Needs It, and What Secure Privacy's DPOaaS Includes
URL: https://support.secureprivacy.ai/article/what-is-dpo-as-a-service-complete-overview
Product: DPO as a Service
Category: DPO Fundamentals
Published: 2026-03-09T20:25:00+00:00
Updated: 2026-03-22T01:28:19.599+00:00
Reading Time: 5 minutes
Summary: Learn what DPO as a Service is, who needs a DPO under GDPR Article 37, the key benefits of DPOaaS, and what Secure Privacy's outsourced Data Protection Officer service includes.
DPO as a Service (DPOaaS) is an outsourced solution that gives organizations access to a qualified Data Protection Officer without the cost and overhead of a full-time in-house hire. Under GDPR Article 37, many organizations are legally required to appoint a DPO — and even those that are not face significant compliance risk without expert data protection guidance. Secure Privacy's DPO as a Service provides certified privacy professionals who fulfil all GDPR Articles 37–39 obligations on your behalf, tailored to your organization's size, sector, and regulatory footprint.
Who Is This For?
- Organizations subject to GDPR that are required to appoint a Data Protection Officer under Article 37
- SMEs and growing businesses that need qualified DPO expertise without a full-time senior hire
- Organizations operating across multiple EU jurisdictions requiring multi-regulatory knowledge
- Any business seeking to reduce GDPR compliance risk and demonstrate accountability to supervisory authorities
What Is DPO as a Service?
DPO as a Service is an outsourced model permitted under GDPR Article 37(6), which explicitly allows the DPO function to be fulfilled by an external service provider under a service contract. Rather than recruiting and employing a full-time DPO — a specialist role in high demand and short supply — organizations engage a qualified external DPO team that provides the same statutory functions at a fraction of the cost, with greater expertise and guaranteed continuity of service.
Secure Privacy's DPO as a Service bridges the gap between mandatory GDPR compliance obligations and the practical realities of resourcing a qualified data protection function — making expert DPO support accessible to organizations of all sizes.
GDPR DPO Requirements: Who Needs to Appoint a DPO?
Under GDPR Article 37, DPO appointment is mandatory in three scenarios:
- The processing is carried out by a public authority or body (except courts acting in their judicial capacity)
- The organization's core activities require regular and systematic monitoring of data subjects on a large scale
- The organization's core activities consist of large-scale processing of special categories of data (Article 9) or data relating to criminal convictions and offenses (Article 10)
Even where mandatory appointment does not apply, the European Data Protection Board recommends appointing a DPO as a best practice for any organization that processes personal data regularly. Voluntary DPO appointment significantly reduces compliance risk and demonstrates GDPR accountability under Article 5(2). Secure Privacy's DPO as a Service is available for both mandatory and voluntary appointments.
Key Benefits of DPO as a Service
Compared to an in-house DPO hire, DPO as a Service offers significant advantages across cost, expertise, independence, and scalability:
Benefit
Description
Cost Efficiency
A fraction of the cost of a full-time DPO hire — no recruitment, onboarding, or ongoing training overhead
Expert Knowledge
Access to a team of certified privacy professionals with cross-industry and multi-jurisdictional experience
Scalability
Service level adjusts as your organization grows, enters new markets, or faces changing regulatory requirements
Independence
External DPOs are naturally independent — satisfying GDPR Article 38 requirements with no internal conflicts of interest
Regulatory Currency
Stay current with evolving GDPR guidance, supervisory authority decisions, and regulatory developments — without internal training investment
Service Continuity
No disruption from leave, illness, or resignation — guaranteed continuity of DPO coverage at all times
What Secure Privacy DPO as a Service Includes
Secure Privacy's DPO as a Service covers the full scope of GDPR Articles 37–39 obligations and operational data protection support:
- Official DPO registration: Your appointed DPO is registered with the relevant supervisory authority under GDPR Article 37(7) from the start of the engagement.
- GDPR compliance monitoring: Ongoing monitoring of your organization's compliance with GDPR and other applicable data protection laws, including national implementing legislation.
- DPIA advice and oversight: Guidance on when Data Protection Impact Assessments are required, review of completed assessments, and monitoring of mitigation implementation.
- Data subject and supervisory authority contact point: Your DPO serves as the accessible, registered contact point for all data subject queries and supervisory authority communications.
- Staff data protection training: Role-specific training delivery and awareness programs covering GDPR obligations across your workforce.
- Compliance audits and reporting: Regular compliance audits and structured reporting to your leadership team — providing documented accountability evidence.
- Breach response and notification support: Expert guidance on breach assessment, 72-hour supervisory authority notification, data subject communication, and breach register documentation.
Getting Started with Secure Privacy DPO as a Service
Onboarding with Secure Privacy's DPO as a Service typically takes two to four weeks and begins with an initial GDPR compliance assessment of your organization. To get started, contact your account manager or explore DPO as a Service plans on the Secure Privacy website.
Frequently Asked Questions
Is DPO as a Service legally valid under GDPR?
Yes. GDPR Article 37(6) explicitly permits the DPO function to be fulfilled by an external service provider under a service contract. A DPOaaS arrangement satisfies all GDPR Article 37–39 obligations — including mandatory supervisory authority registration, accessibility to data subjects, independence requirements, and the full scope of Article 39 tasks — provided the service agreement is structured to reflect these obligations.
How quickly can a DPO as a Service be operational?
Unlike an in-house hire — which involves a recruitment process, notice period, and onboarding timeline that can take several months — Secure Privacy's DPO as a Service can be operational within days of contract execution. DPO registration with the supervisory authority is completed at engagement confirmation, ensuring your organization is formally compliant from the outset.
What is included in the initial compliance assessment?
The initial compliance assessment is a structured gap analysis covering your existing privacy policies, ROPA, security measures, data subject rights processes, vendor agreements, and international transfer arrangements. Findings are used to build your prioritized compliance roadmap — identifying critical issues for immediate action and medium-term improvements for the months ahead.
Can Secure Privacy's DPO as a Service support organizations in multiple countries?
Yes. Secure Privacy's DPO team has multi-jurisdictional expertise covering GDPR requirements across EU member states, UK GDPR, and applicable national data protection legislation. The compliance assessment and ongoing support account for all jurisdictions in which your organization operates — from supervisory authority registration to national-law-specific compliance obligations.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# DPO as a Service Onboarding – Five-Step GDPR Compliance Setup Process with Secure Privacy
URL: https://support.secureprivacy.ai/article/how-to-onboard-with-dpo-as-a-service
Product: DPO as a Service
Category: DPO Fundamentals
Published: 2026-03-09T20:25:00+00:00
Updated: 2026-03-22T01:26:39.961+00:00
Reading Time: 5 minutes
Summary: Learn how Secure Privacy's DPO as a Service onboarding works — from initial GDPR gap analysis and DPO registration through to a prioritized compliance roadmap and ongoing support.
Getting started with Secure Privacy's DPO as a Service is a structured five-step onboarding process designed to establish your organization's GDPR compliance baseline, register your appointed DPO with the relevant supervisory authority, and deliver a prioritized compliance roadmap from day one. This guide walks you through each phase — from the initial discovery consultation through to ongoing DPO support.
Who Is This For?
- Organizations that have purchased or are evaluating Secure Privacy's DPO as a Service
- Legal and compliance teams coordinating the DPO onboarding process internally
- Senior leadership seeking to understand what the DPO engagement process involves and what it delivers
- IT, HR, and operational teams who will be involved in the compliance gap analysis and policy review stages
DPO as a Service Onboarding Overview
Secure Privacy's DPO onboarding process is designed to move your organization from initial engagement to active GDPR compliance support as efficiently as possible — with no compliance gaps left unaddressed. The process runs across five structured phases, each building on the last to establish a complete, documented compliance foundation.
Step 1: Initial Consultation and Discovery
The onboarding process begins with a structured discovery call where your assigned DPO team assesses your organization's current data protection posture and compliance context:
- Your organization's size, structure, and industry sector
- Types of personal data you process and the lawful bases currently relied upon
- Existing data protection measures, policies, and documentation
- The jurisdictions in which you operate and the applicable regulatory frameworks
- Any known compliance gaps, active regulatory matters, or upcoming compliance deadlines
Step 2: GDPR Compliance Gap Analysis
Following the initial consultation, your assigned DPO conducts a thorough compliance gap analysis across all key areas of your data protection program. This assessment identifies existing strengths and prioritizes areas requiring immediate or near-term remediation:
- Privacy policy and notice review: Assess whether existing privacy notices meet GDPR Articles 13 and 14 transparency requirements.
- Data processing records assessment: Review the completeness and accuracy of your Record of Processing Activities (ROPA) under GDPR Article 30.
- Technical and organizational security measures: Evaluate whether security measures meet the GDPR Article 32 standard appropriate to the risk.
- Data subject rights fulfillment processes: Review how your organization handles DSARs, erasure requests, and other data subject rights under GDPR Articles 15–22.
- Third-party data processing agreements: Assess DPA coverage for all vendors and processors handling personal data on your behalf.
- Cross-border data transfer mechanisms: Evaluate whether international data transfers are covered by appropriate GDPR Chapter V mechanisms.
Step 3: DPO Registration Under GDPR Article 37(7)
Once the engagement is confirmed, Secure Privacy registers your appointed DPO with the relevant supervisory authority as required by GDPR Article 37(7). This step includes publishing the DPO's contact details — ensuring data subjects can contact your DPO directly and that the supervisory authority has the correct point of contact for all regulatory communications from the outset of the engagement.
Step 4: Prioritized GDPR Compliance Roadmap
Based on the gap analysis findings, your DPO prepares a structured, prioritized compliance roadmap with clear action items, owners, and timelines:
Priority
Action Item
Timeline
Critical
Address any active non-compliance issues identified in the gap analysis
Weeks 1–2
High
Implement missing policies, procedures, and documentation
Weeks 2–4
Medium
Staff data protection training and awareness programs
Weeks 4–8
Ongoing
Continuous compliance monitoring, periodic reviews, and reporting
Monthly
Step 5: Ongoing DPO Support and Compliance Monitoring
After the onboarding phases are complete, your Secure Privacy DPO transitions into continuous support mode — providing the full range of GDPR Articles 37–39 services on an ongoing basis:
- Regular compliance check-ins and progress reviews against the roadmap
- Continuous monitoring of your data protection posture and processing activities
- Advisory support for new projects, processing activities, and vendor engagements
- Breach response management and supervisory authority liaison as needed
- Periodic compliance reporting delivered to your leadership team
Your DPO is accessible at any time through the Secure Privacy platform — ensuring your organization always has expert data protection guidance available when it is needed. Learn more about Secure Privacy DPO as a Service.
Frequently Asked Questions
How long does the DPO as a Service onboarding process take?
The onboarding timeline depends on the size and complexity of your organization and the extent of the compliance gaps identified. Critical issues are typically addressed within the first two weeks, with the full compliance roadmap implemented over the first one to two months. DPO registration with the supervisory authority is completed at the point of engagement confirmation — ensuring your organization is formally compliant from the outset.
What information does my organization need to provide during onboarding?
Your DPO team will work through the discovery consultation to gather the necessary information — including your existing privacy policies, any current data processing records or ROPA, vendor agreements, security documentation, and details of any known compliance gaps or regulatory matters. Your internal teams will be guided through what is needed at each stage.
What happens if the gap analysis identifies critical compliance issues?
Critical findings are addressed immediately in the first two weeks of the compliance roadmap. Your DPO will advise on the specific remediation actions required, work with your team to prioritize and implement them, and document the steps taken — ensuring your organization moves out of active non-compliance as quickly as possible.
Can Secure Privacy's DPO as a Service support organizations in multiple jurisdictions from the start of onboarding?
Yes. The initial discovery consultation specifically covers all jurisdictions in which your organization operates, and the gap analysis accounts for both GDPR requirements and applicable national data protection legislation in each relevant member state. Your compliance roadmap reflects the full regulatory footprint of your organization from day one.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# GDPR DPO Appointment Requirements – When Is a Data Protection Officer Mandatory Under Article 37?
URL: https://support.secureprivacy.ai/article/when-is-appointing-a-dpo-mandatory
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T20:25:00+00:00
Updated: 2026-03-22T01:02:16.558+00:00
Reading Time: 5 minutes
Summary: Learn when GDPR Article 37 makes DPO appointment mandatory, what large-scale processing means, national requirements across EU member states, and when voluntary appointment is recommended.
Under GDPR Article 37, certain organizations are legally required to appoint a Data Protection Officer (DPO). The conditions for mandatory appointment are broader than many organizations assume — and several EU member states impose additional national requirements beyond the GDPR baseline. This guide explains when a DPO appointment is mandatory, what "large-scale processing" means in practice, and when a voluntary appointment is strongly recommended even if not legally required.
Who Is This For?
- Legal and compliance teams assessing whether their organization is required to appoint a DPO under GDPR
- Data Protection Officers and privacy managers advising leadership on DPO appointment obligations
- Organizations operating across multiple EU member states subject to national DPO requirements
- Growing businesses evaluating whether their current or planned processing activities trigger mandatory appointment
GDPR Article 37: When Is DPO Appointment Mandatory?
Not every organization is required to appoint a DPO under GDPR — but the mandatory conditions are more widely applicable than many organizations realize. Under GDPR Article 37(1), DPO appointment is mandatory in three scenarios:
- Public authorities or bodies: Any organization that is a public authority or body — except courts acting in their judicial capacity — must appoint a DPO.
- Large-scale systematic monitoring: Organizations whose core activities require regular and systematic monitoring of individuals on a large scale — for example, behavioral advertising networks, telecom operators, or organizations using tracking technologies at scale.
- Large-scale special category data processing: Organizations whose core activities involve large-scale processing of special categories of personal data under GDPR Article 9 (such as health, biometric, or religious data) or data relating to criminal convictions and offenses under Article 10.
What Does "Large-Scale Processing" Mean Under GDPR?
GDPR does not define a precise numeric threshold for large-scale processing. The European Data Protection Board (EDPB) advises that the following factors should be considered when determining whether processing qualifies as large scale:
- The number of data subjects concerned — either as a specific figure or as a proportion of the relevant population
- The volume of data or range of data items being processed
- The duration or permanence of the data processing activity
- The geographical extent of the processing — local, regional, national, or international
Where there is genuine doubt about whether your processing qualifies as large scale, your DPO can conduct an assessment and document the reasoning — providing a defensible position if the question is raised by a supervisory authority.
National DPO Appointment Requirements Across EU Member States
Several EU member states have enacted national legislation that imposes DPO appointment obligations beyond the GDPR Article 37 baseline. Organizations operating in multiple jurisdictions must assess both GDPR requirements and applicable national rules:
Country
Additional DPO Appointment Requirement
Germany
Organizations with 20 or more employees regularly processing personal data must appoint a DPO under the Federal Data Protection Act (BDSG)
France
DPO appointment is strongly recommended for all organizations processing personal data; the CNIL has issued binding guidance on DPO obligations
Austria
Organizations that systematically process personal data as their primary activity are required to appoint a DPO
Poland
Public entities and organizations processing special categories of personal data are required to appoint a DPO under Polish national law
When Voluntary DPO Appointment Is Recommended
Even where GDPR Article 37 does not strictly require a DPO, the European Data Protection Board recommends voluntary appointment for organizations that process personal data regularly or at meaningful scale. Consider appointing a DPO if:
- You process customer, employee, or user data on an ongoing basis
- You operate across multiple EU jurisdictions subject to varying national requirements
- Your organization is growing in a way that may trigger mandatory DPO thresholds in the near future
- You want to demonstrate GDPR accountability and good data governance to regulators, customers, and partners
Secure Privacy's DPO as a Service makes it straightforward to meet mandatory and voluntary DPO requirements without the cost and overhead of a full-time in-house hire.
Frequently Asked Questions
Does a DPO need to be an employee of the organization?
No. GDPR Article 37(6) explicitly permits the DPO role to be fulfilled by an external service provider under a contract. A DPO as a Service arrangement — such as that offered by Secure Privacy — satisfies this requirement and provides access to specialist expertise without the cost of a full-time hire.
What happens if an organization fails to appoint a mandatory DPO?
Failure to appoint a DPO when required under GDPR Article 37 is a direct violation of GDPR and can result in enforcement action and fines of up to €10 million or 2% of global annual turnover under GDPR Article 83(4). Supervisory authorities have issued fines for this specific failure in several EU member states.
Can one DPO serve multiple organizations?
Yes. GDPR Article 37(3) allows a single DPO to be appointed for a group of undertakings or a group of public authorities, provided the DPO is easily accessible from each entity. Availability and accessibility requirements must be met in practice, not just on paper.
How does an organization assess whether its processing triggers the mandatory DPO threshold?
Organizations should document their core processing activities and assess each against the three Article 37(1) scenarios — public authority status, large-scale systematic monitoring, and large-scale special category data processing — using the EDPB's large-scale assessment factors. Where the answer is uncertain, the assessment and its reasoning should be documented. Secure Privacy's DPO can conduct and document this assessment on your behalf.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# In-House DPO vs DPO as a Service – GDPR Article 37(6) Comparison, Costs, and When Each Makes Sense
URL: https://support.secureprivacy.ai/article/dpo-as-a-service-vs-in-house-dpo
Product: DPO as a Service
Category: DPO Fundamentals
Published: 2026-03-09T20:25:00+00:00
Updated: 2026-03-22T01:23:28.184+00:00
Reading Time: 5 minutes
Summary: Compare in-house DPO vs DPO as a Service under GDPR Article 37(6) — covering cost, expertise, independence, scalability, and when each model is the right choice for your organization.
Under GDPR Article 37(6), the DPO function can be fulfilled by either an in-house employee or an external service provider. Both approaches are legally valid — but they differ significantly in cost, expertise, independence, and scalability. This guide compares in-house DPO and DPO as a Service (DPOaaS) across the key factors to help your organization make the right choice for its size, structure, and compliance requirements.
Who Is This For?
- Legal and compliance leads evaluating DPO appointment options under GDPR Article 37
- HR and finance teams assessing the cost and resourcing implications of in-house vs external DPO models
- Senior leadership and board members responsible for data protection governance decisions
- SMEs, startups, and growing organizations weighing DPO as a Service against internal hiring
In-House DPO vs DPO as a Service: Detailed Comparison
GDPR Article 37(6) explicitly permits the DPO role to be fulfilled by an external service provider under a service contract. The table below compares the two models across the factors that matter most to organizations making this decision:
Factor
In-House DPO
DPO as a Service
Annual Cost
$80,000–$180,000+ including salary, benefits, and ongoing training
Fraction of the cost — predictable monthly service fee with no recruitment overhead
Expertise
Single individual's knowledge base — depth varies by background and continuing development
Access to a team of specialists with cross-industry and multi-jurisdictional experience
Independence
May face internal pressure, reporting line conflicts, or organizational politics
Naturally independent as an external party — no internal conflicts of interest
Availability
Subject to leave, illness, resignation, and knowledge loss on departure
Guaranteed continuity of service regardless of individual availability
Scalability
Limited to one individual's capacity — additional resource requires additional hire
Scales with your organization's evolving compliance needs without additional hiring
Regulatory Knowledge
May specialize in one jurisdiction or sector — breadth depends on the individual
Multi-jurisdictional and cross-sector expertise distributed across the service team
Recruitment
Lengthy hiring process in a competitive and specialist talent market
Immediate access to qualified DPO professionals — no recruitment delay
Organizational Knowledge
Deep understanding of internal operations, culture, and systems from day one
Built progressively through structured onboarding and ongoing engagement
When an In-House DPO Makes Sense
An in-house DPO appointment is most appropriate in a limited set of circumstances where the depth of internal organizational knowledge and continuous presence outweigh the cost and scalability advantages of DPOaaS:
- Very large organizations with complex, high-volume, and continuous data processing needs that require a full-time dedicated resource embedded within the business.
- Organizations where data protection is a core competitive differentiator — such as data-intensive technology companies where privacy strategy is integral to product development and market positioning.
- Organizations with highly specialized or sensitive data processing requirements — such as defense, intelligence-adjacent, or critical national infrastructure sectors where external access is restricted.
When DPO as a Service Is the Better Choice
For most organizations subject to GDPR, DPO as a Service offers a more cost-effective, flexible, and expertise-rich solution than an in-house hire:
- Small to medium-sized organizations that need qualified DPO guidance and accountability documentation without the cost of a full-time senior hire.
- Organizations operating across multiple EU jurisdictions where diverse regulatory knowledge — covering different supervisory authority expectations and national implementing legislation — is required.
- Organizations looking to reduce compliance overhead while maintaining full GDPR accountability, reporting, and supervisory authority liaison capabilities.
- Startups and rapidly growing companies where data processing activities, headcount, and regulatory exposure change quickly and compliance requirements need to scale accordingly.
- Any organization where an internal DPO appointment could create conflicts of interest — for example, where the only suitable internal candidate also holds a role that involves making data processing decisions.
The Hybrid DPO Model
Some organizations adopt a hybrid approach: an internal privacy champion or data protection coordinator handles day-to-day privacy activities and acts as the internal point of contact, while an external DPO service fulfils the formal GDPR Article 37–39 obligations — including supervisory authority liaison, DPIA sign-off, breach notification, and compliance reporting.
Secure Privacy's DPO as a Service is designed to support this model. Your external DPO works alongside your internal privacy team, providing expert oversight and formal accountability while your internal coordinator manages operational privacy tasks. Learn more about the Secure Privacy DPO as a Service.
Frequently Asked Questions
Is a DPO as a Service legally equivalent to an in-house DPO under GDPR?
Yes. GDPR Article 37(6) explicitly states that the DPO function can be fulfilled by an external service provider under a service contract. A DPOaaS arrangement satisfies the same GDPR Article 37–39 obligations as an in-house appointment — including supervisory authority registration, accessibility requirements, and independence obligations — provided the service agreement is structured correctly.
What are the GDPR independence requirements for a DPO?
GDPR Article 38(3) requires that the DPO does not receive instructions regarding the exercise of their tasks, does not be dismissed or penalized for performing those tasks, and reports directly to the highest management level of the organization. An external DPO as a Service is inherently well-positioned to meet these independence requirements, as the service provider has no employment relationship with the organization and no conflicting internal responsibilities.
Can a DPO as a Service be easily accessible to data subjects and supervisory authorities?
Yes — provided the DPOaaS contract includes clear accessibility provisions. GDPR Article 38(4) requires the DPO to be accessible to data subjects for queries about their rights and to supervisory authorities for compliance matters. Secure Privacy's DPO as a Service includes defined contact channels and response commitments that satisfy this requirement.
How quickly can a DPO as a Service be operational?
Unlike an in-house hire — which involves a recruitment process, notice period, and onboarding timeline that can take several months — a DPO as a Service can typically be operational within days of contract execution. Secure Privacy provides a structured onboarding process to build organizational knowledge quickly, ensuring your DPO can fulfil their obligations from the outset.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# Data Protection Officer Role – GDPR Articles 37–39, Mandatory Tasks, Independence Requirements, and DPOaaS
URL: https://support.secureprivacy.ai/article/dpo-roles-and-responsibilities-under-gdpr
Product: DPO as a Service
Category: DPO Fundamentals
Published: 2026-03-09T20:25:00+00:00
Updated: 2026-03-22T01:25:03.962+00:00
Reading Time: 6 minutes
Summary: Learn what GDPR Articles 37–39 require of a Data Protection Officer — mandatory tasks, independence protections, practical responsibilities, and how Secure Privacy's DPO as a Service fulfils them.
The Data Protection Officer (DPO) is a formally designated role under GDPR Articles 37–39, responsible for advising on compliance, monitoring data protection obligations, overseeing DPIAs, and acting as the official contact point between your organization and the supervisory authority. This guide explains the mandatory tasks, independence requirements, and practical responsibilities of the DPO role — and how Secure Privacy's DPO as a Service fulfils all GDPR Article 39 obligations on your organization's behalf.
Who Is This For?
- Organizations subject to GDPR that are required or considering appointing a Data Protection Officer
- Legal and compliance teams seeking to understand what the DPO role requires under GDPR Articles 37–39
- Senior leadership and boards responsible for data protection governance and DPO oversight
- Privacy professionals evaluating whether an in-house or external DPO model best meets their obligations
The Role of the Data Protection Officer Under GDPR
The DPO plays a central role in ensuring an organization's ongoing compliance with GDPR and other applicable data protection regulations. Unlike a general compliance function, the DPO is a formally designated position with specific statutory tasks, strict independence protections, and a direct reporting line to the highest level of management. GDPR Articles 37–39 define the conditions for appointment, the independence requirements, and the minimum tasks the DPO must fulfil.
GDPR Article 39 Mandatory DPO Tasks
GDPR Article 39 sets out the minimum tasks every DPO must perform. These are baseline obligations — not an exhaustive description of what a well-functioning DPO program delivers in practice:
Inform and advise on data protection obligations
The DPO informs and advises the controller, processor, and employees about their obligations under GDPR and other applicable data protection law — ensuring decision-makers across the organization understand the privacy implications of their activities before processing begins.
Monitor GDPR compliance
The DPO monitors compliance with GDPR, other EU or member state data protection provisions, and the organization's internal data protection policies — including assigning responsibilities, raising awareness, and conducting regular compliance assessments.
Advise on and oversee DPIAs
The DPO provides advice on when Data Protection Impact Assessments are required under GDPR Article 35, reviews completed assessments for sufficiency, and monitors the implementation of mitigation measures identified in the DPIA process.
Cooperate with and act as contact point for the supervisory authority
The DPO is the designated contact point for all supervisory authority communications — including breach notifications, prior consultation requests, complaints, inquiries, and investigations — and cooperates with the authority on all processing-related matters under GDPR Article 39(1)(d-e).
Take due regard of risk in processing operations
When performing their tasks, the DPO takes due account of the risk associated with each processing activity — considering the nature, scope, context, and purposes of processing — and prioritizes their activities accordingly.
GDPR Article 38 DPO Independence Requirements
GDPR Article 38 establishes strict protections for the DPO's independence — requirements that are non-negotiable and that supervisory authorities actively assess during investigations:
- No instructions on DPO tasks: The DPO must not receive instructions from the controller or processor regarding the exercise of their tasks — they must be free to form their own professional judgments on compliance matters.
- Protection from dismissal or penalty: The DPO cannot be dismissed, penalized, or disadvantaged for performing their duties — including when their advice conflicts with the organization's preferred course of action.
- Direct reporting to senior management: The DPO must report directly to the highest management level — ensuring their findings and recommendations reach the appropriate decision-making level without being filtered through intermediate management.
- No conflict of interest: The DPO must not hold a position within the organization that would lead to a conflict of interest with their DPO responsibilities — for example, a role that involves making data processing decisions that the DPO would then be required to oversee.
The independence requirement is one of the primary reasons organizations choose an external DPO through a service like Secure Privacy — an external provider is naturally independent, with no employment relationship or conflicting internal responsibilities that could compromise the role.
DPO Responsibilities in Practice
Beyond the minimum Article 39 tasks, a well-functioning DPO program covers the full range of operational data protection responsibilities:
Area
Responsibilities
Policy Management
Review and advise on privacy policies, data retention schedules, and internal data protection procedures
Staff Training
Deliver role-specific data protection training and ensure all employees understand their GDPR obligations
Breach Management
Advise on breach detection, risk assessment, 72-hour notification, data subject communication, and breach register documentation
DPIA Oversight
Advise on when DPIAs are required, review assessments for GDPR Article 35 compliance, and monitor mitigation implementation
Data Subject Rights
Oversee processes for responding to DSARs, erasure requests, rectification, restriction, and objection within GDPR deadlines
Vendor Management
Review Data Processing Agreements, maintain the vendor register, and advise on third-party processor risk and international transfers
How Secure Privacy's DPO as a Service Fulfils GDPR Requirements
When you engage Secure Privacy's DPO as a Service, our appointed DPO fulfils all mandatory GDPR Articles 37–39 requirements — including supervisory authority registration, breach notification, DPIA oversight, and staff training — while maintaining full structural independence as an external service provider.
Regular compliance reports keep your leadership informed of your organization's data protection posture, and the Secure Privacy governance platform provides complete transparency into all DPO activities, documentation, and risk management. Learn more about Secure Privacy DPO as a Service.
Frequently Asked Questions
What is the difference between the DPO's tasks under Article 39 and their broader responsibilities?
GDPR Article 39 defines the minimum mandatory tasks every DPO must perform — the legal baseline. In practice, an effective DPO program extends well beyond these minimum tasks to cover policy management, staff training, vendor oversight, breach response, ROPA maintenance, and ongoing compliance monitoring. The Article 39 tasks are the floor, not the ceiling, of what a well-functioning DPO delivers.
Can the DPO be overruled by senior management on a compliance matter?
No. GDPR Article 38(3) prohibits instructions to the DPO regarding the exercise of their tasks. The data controller remains the decision-maker on whether to proceed with a processing activity, but they cannot instruct the DPO to change their compliance advice or findings. Where the controller proceeds against the DPO's advice, both the advice and the controller's decision should be documented — providing an important accountability record if the matter is later reviewed by a supervisory authority.
What qualifications does a DPO need under GDPR?
GDPR Article 37(5) requires the DPO to be appointed based on professional qualities — in particular, expert knowledge of data protection law and practices — and the ability to fulfil the tasks set out in Article 39. GDPR does not mandate a specific qualification or certification, but the DPO must have sufficient legal and technical knowledge to advise credibly on the full scope of the organization's data processing activities.
How does the DPO report to senior management in practice?
GDPR Article 38(3) requires the DPO to report directly to the highest management level — typically the board, CEO, or equivalent. In practice, this is typically fulfilled through regular written compliance reports, quarterly or annual board presentations, and direct escalation of high-risk findings. Secure Privacy's DPO as a Service includes structured reporting cycles designed to satisfy this obligation and keep leadership appropriately informed.
See Also
- Setup DSAR Forms in Secure Privacy
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# Privacy Program Maturity Scoring – How the Governance Solution Measures and Benchmarks GDPR Compliance
URL: https://support.secureprivacy.ai/article/understanding-privacy-program-maturity-scoring
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:56:00+00:00
Updated: 2026-03-22T15:56:34.547+00:00
Reading Time: 5 minutes
Summary: Understand how Secure Privacy's Governance Solution scores your privacy program maturity across six GDPR dimensions — with maturity levels, risk indicators, cross-entity benchmarking, and improvement guidance.
Secure Privacy's Governance Solution evaluates your organization's privacy program maturity across six key dimensions — giving compliance teams, privacy officers, and executive leadership a clear, scored view of where the program stands and where improvements are needed. Maturity scores are used across the Dashboard, compliance reports, and Cross-Company Analytics to support benchmarking, gap analysis, and regulatory accountability.
Who Is This For?
- Privacy officers tracking privacy program improvement over time and identifying dimension-level gaps
- Executives and board members who need a high-level view of organizational compliance readiness
- Compliance managers benchmarking maturity scores across multiple entities, regions, or business units
Privacy Maturity Scoring Model
Your privacy program maturity score is calculated as a percentage (0–100%) based on your organization's performance across six dimensions. Each dimension reflects a core area of GDPR compliance program effectiveness:
Dimension
What It Measures
Governance
Organizational structure, defined roles, and accountability frameworks including DPO appointment
Policies
Privacy policy documentation, review cycles, and coverage across applicable processing activities
Data Inventory
Completeness of data mapping, system inventory, and process documentation in the ROPA
Individual Rights
DSAR handling capabilities, response times, and performance against GDPR deadlines
Security
Technical and organizational security measures in place across systems processing personal data
Risk Management
Risk identification, scoring, mitigation activities, and DPIA completion for high-risk processing
Privacy Program Maturity Levels
Based on the overall score, the platform assigns a maturity classification that reflects the current state of your privacy program:
Maturity Level
Score Range
Description
Reactive Maturity
0–40%
Privacy program is in early stages with significant compliance gaps requiring prioritized remediation
Developing Maturity
41–70%
Core compliance elements are in place but gaps remain across one or more dimensions
Proactive Maturity
71–100%
Comprehensive privacy program with strong controls, documented processes, and continuous improvement
Risk Level Indicators
Alongside the maturity score, the platform assigns a risk level indicator reflecting the organization's current compliance exposure:
- High Risk: Significant compliance gaps requiring immediate attention — typically associated with Reactive Maturity scores
- Medium Risk: Some areas need improvement but core controls are in place — typically associated with Developing Maturity
- Low Risk: Strong compliance posture with minimal gaps — typically associated with Proactive Maturity
Cross-Entity Privacy Maturity Comparison
For organizations managing multiple entities, the Privacy Program Maturity Comparison report provides structured cross-entity benchmarking:
- Side-by-side maturity scoring across all entities in your portfolio
- Spider chart visualizations showing dimension-by-dimension performance for each entity
- Identification of highest and lowest scoring entities — highlighting where intervention is most needed
- Average, highest, and lowest scores across the full entity portfolio for executive reporting
Improving Your Privacy Maturity Score
Each dimension of the maturity score can be improved through targeted actions within the Governance Solution:
Complete your data mapping
Ensure all processing activities and systems are fully documented in the Process Register and Systems Management modules. Incomplete ROPA coverage is one of the most common causes of low Data Inventory scores.
Maintain up-to-date policies
Upload current versions of all privacy policies and procedures to the Document Repository, and set annual review reminders in the Compliance Calendar. Outdated or missing policies directly reduce your Policies dimension score.
Address open risks
Work through your risk register systematically — implementing mitigation plans, updating risk status as actions are completed, and closing resolved items. Active risk remediation improves your Risk Management score in real time.
Handle DSARs promptly
Respond to all data subject requests within GDPR's one-month deadline. DSAR response performance is a direct input into the Individual Rights dimension — consistently missed deadlines will reduce this score.
Complete DPIAs for high-risk processing
Run Data Protection Impact Assessments for all processing activities that meet the GDPR Article 35 threshold. Incomplete DPIA coverage for high-risk items negatively affects both the Risk Management and Governance dimensions.
Assign ownership to all items
Ensure every process, system, and risk record has a clearly assigned owner. Unowned compliance items are treated as accountability gaps — assigning ownership across your compliance program improves scores across multiple dimensions simultaneously.
Using Maturity Scores in Compliance Reports
Maturity scores are surfaced across several reports in the Reporting & Analytics module:
- Compliance Dashboard: Overall maturity score with a dimension-by-dimension breakdown for the current organization
- Executive Summary: High-level maturity overview formatted for board and leadership reporting
- Privacy Program Comparison: Cross-entity maturity benchmarking with spider chart visualizations
- Cross-Company Analytics: Aggregated maturity metrics across all organizations managed in the platform
Next Steps
- Review your current maturity score and dimension breakdown on the Dashboard
- Use the Gap Analysis report to identify the lowest-scoring dimensions and prioritize remediation
- Create targeted tasks in Task Management to address identified compliance gaps
- Schedule regular maturity reviews in the Compliance Calendar to track improvement over time
Frequently Asked Questions
How frequently is the maturity score updated?
The maturity score updates in real time as compliance activities are completed within the Governance Solution — including adding new process records, completing risk mitigations, handling DSARs, and uploading policy documents. There is no need to manually trigger a recalculation; the score always reflects your current program status.
Can the maturity score be used as evidence of GDPR compliance for supervisory authorities?
The maturity score itself is an internal assessment tool rather than a formal regulatory certification. However, the detailed compliance data that underlies the score — including your ROPA, risk register, DPIA records, and DSAR performance metrics — can be exported from the Governance Solution as audit-ready evidence for supervisory authority review under GDPR Article 5(2) accountability requirements.
What is the fastest way to move from Reactive to Developing maturity?
The highest-impact actions for organizations at Reactive maturity are typically: completing data mapping in the Process Register, uploading current privacy policies to the Document Repository, assigning ownership to all systems and processes, and addressing any open High-risk items in the risk register. These actions span multiple scoring dimensions and generate rapid score improvement.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# DSAR Handling Module – GDPR Data Subject Request Management, Deadline Tracking, and Audit Logging in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/how-to-handle-dsars-governance-platform
Product: Privacy & AI Governance
Category: DSARs
Published: 2026-03-09T17:56:00+00:00
Updated: 2026-03-22T16:39:43.556+00:00
Reading Time: 5 minutes
Summary: Manage GDPR and CCPA data subject access requests end-to-end using the DSAR Handling module in Secure Privacy's Governance Solution — with automated deadline tracking, secure data handling, and full audit logging.
The DSAR Handling module in Secure Privacy's Governance Solution manages the full lifecycle of Data Subject Access Requests — from intake and identity verification through to response delivery and audit logging. It helps your organization meet the legal response timeframes required by GDPR (30 days), CCPA (45 days), and other applicable privacy regulations, while maintaining a complete, defensible audit record of every action taken.
Who Is This For?
- Privacy officers overseeing DSAR response processes and ensuring regulatory deadline compliance
- Legal teams ensuring timely, compliant responses to all data subject rights requests
- Support staff handling incoming data requests and coordinating the response workflow across departments
Accessing DSAR Handling
From the left sidebar in the Governance Solution, navigate to Compliance > DSARs. The main view displays all requests in a filterable table with real-time status indicators and deadline tracking.
Creating and Processing a DSAR
Step 1: Click + Add Request
Click + Add Request in the top-right corner to log a new data subject rights request.
Step 2: Fill in request details
Complete the following fields to fully document the incoming request:
Field
Description
Example
Subject
Email address or identifier of the data subject submitting the request
user@example.com
Request Type
The specific data subject right being exercised
Access Request, Erasure, Rectification, Portability
Status
Current handling status of the request
Pending, In Progress, Completed
Due Date
Response deadline — automatically calculated based on the applicable regulation and receipt date
2025-06-22
Related Processes
Link to relevant data processing activities in the Process Register
Customer Data Processing
Assignees
Team members responsible for handling and responding to the request
dan@company.com
Response Time
Legal response timeframe for the applicable regulation
30 days (GDPR), 45 days (CCPA)
Step 3: Process the request
Work through the request by gathering the required personal data, verifying the data subject's identity, and preparing the response. Update the status field as work progresses to keep the record current and all assignees informed.
GDPR DSAR Deadline Tracking
The platform automatically calculates and tracks the response deadline for each request based on receipt date and applicable regulation. A visual progress bar shows how much time remains, with color-coded indicators providing at-a-glance urgency signals:
- Green — Plenty of time remaining; request is on track
- Yellow — Deadline approaching with less than 50% of response time remaining
- Red — Deadline imminent or overdue; immediate action required
DSAR Secure Data Handling
The DSAR module applies enterprise-grade security controls to all personal data handled during the request process:
- Files and attachments are encrypted at rest and in transit using AES-256 and TLS 1.2+
- Access to request records and attached data is restricted to assigned team members only
- All data access events are logged automatically for audit purposes
- Completed response packages can be securely shared with the data subject when ready
Custom DSAR Intake Controls
Customize your DSAR intake form with custom fields to collect the specific information your organization needs to process requests efficiently. See the dedicated DSAR Custom Controls article for step-by-step configuration instructions.
DSAR Audit Trail for Regulatory Accountability
Every action related to a DSAR record is automatically logged — including creation, status changes, communications, file uploads, assignee changes, and completion. This provides a complete, timestamped, defensible record of your response process for supervisory authority review under GDPR Article 5(2) and Article 12 accountability requirements.
DSAR Performance Reporting
The DSAR Performance report in the Reporting & Analytics module provides operational insights into your DSAR program:
- Average response times across all request types
- Completion rates broken down by request type
- Trending request volumes over time — identifying seasonal patterns or spikes
- Overdue request analysis — highlighting systemic process issues requiring intervention
DSAR Handling Best Practices
Verify identity before processing any request
GDPR Article 12 allows organizations to request additional information to confirm a data subject's identity where there is reasonable doubt. Always document the verification method and outcome before sharing any personal data in a response.
Assign DSARs to specific team members immediately on receipt
Unassigned requests are the most common cause of missed DSAR deadlines. Log and assign every incoming request on the day it is received — ensuring accountability is established from the outset and the deadline clock is visible to the responsible team member.
Use deadline tracking to monitor all open requests
Review the DSAR register regularly and prioritize any requests showing yellow or red deadline indicators. Do not wait for automated reminders alone — an active weekly review prevents deadline breaches caused by unexpected complexity or delays.
Maintain detailed notes throughout the response process
Document every decision made during the DSAR response — including data searches conducted, exemptions considered, and the rationale for any refusals. Detailed notes create the audit-ready record needed to defend your response process to a supervisory authority.
Review DSAR performance metrics monthly
Use the DSAR Performance report to identify trends in response times, request volumes, and overdue rates. Monthly reviews allow compliance teams to spot process bottlenecks and implement improvements before they become systemic compliance failures.
Next Steps
- Configure your DSAR intake form using DSAR Custom Controls to collect the information specific to your organization's request types
- Monitor DSAR response times and completion rates through Reporting & Analytics
- Set DSAR deadline reminders in the Compliance Calendar for proactive deadline management
Frequently Asked Questions
Does the module support CCPA requests as well as GDPR DSARs?
Yes. The DSAR Handling module supports requests under multiple privacy regulations — including GDPR (30-day response requirement) and CCPA (45-day response requirement). The applicable response timeframe is automatically calculated based on the regulation selected when the request is logged.
What happens if a DSAR response deadline is missed?
Failing to respond within the legal timeframe is a direct regulatory breach — under GDPR, this can trigger supervisory authority complaints and enforcement action. The platform's red deadline indicator and automated reminders are designed to prevent this, but if a deadline is missed, document the reason immediately and issue the response as quickly as possible with a written explanation to the data subject as required under GDPR Article 12(3).
Can DSARs be linked to specific processing activities in the Process Register?
Yes. The Related Processes field allows each DSAR to be linked to the relevant data processing activities documented in the Process Register — creating end-to-end traceability from the data subject's request to the processing activity that generated their personal data.
See Also
- How to Handle Data Subject Access Requests (DSARs) – Step-by-Step Process
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Members Module – Role-Based Access Control, Team Ownership Assignment, and Accountability Tracking in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/managing-team-members-role-based-access-governance-platform
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:56:00+00:00
Updated: 2026-03-22T16:10:02.923+00:00
Reading Time: 5 minutes
Summary: Manage team member roles, assign compliance ownership, and maintain a full accountability audit trail using the Members module in Secure Privacy's Governance Solution.
The Members module in Secure Privacy's Governance Solution lets you manage team member access, assign ownership of tasks, risks, assessments, and processes, and maintain a complete audit trail of all responsibility changes. Role-based access controls ensure each team member can only access the areas relevant to their role — supporting both operational security and GDPR accountability across your organization.
Who Is This For?
- Administrators managing user access, permissions, and team member onboarding and offboarding
- Compliance managers assigning and tracking responsibilities across teams and departments
- Privacy officers ensuring proper accountability structures are in place and documented for regulatory purposes
Accessing the Members Module
From the left sidebar in the Governance Solution, click Members. The main view displays all team members with their role, department, and current involvement across processes, tasks, risks, and impact assessments.
Adding a Team Member
Step 1: Click + Add Member
Click the + Add Member button in the top-right corner of the Members view.
Step 2: Enter member details
Enter the team member's email address. They will receive an invitation to join the organization on the Governance Solution platform.
Step 3: Assign a role
Select the appropriate role based on the team member's responsibilities and the level of access they require:
Role
Access Level
Owner
Full access to all modules, settings, and user management — typically assigned to the primary account administrator
Admin
Full access to all compliance modules — cannot manage organization-level settings or billing
Member
Access limited to items and modules specifically assigned to them — suitable for team members with defined, scoped responsibilities
Role-Based Access Control
Role assignments in the Members module directly govern what each team member can view and edit across the Governance Solution. Following the principle of least privilege — granting only the access each person needs for their role — reduces the risk of unauthorized changes to compliance records and supports GDPR data minimization principles as applied to internal system access.
Member Involvement Tracking
The Members table provides an at-a-glance view of each team member's current compliance responsibilities across the platform:
- Processes: Number of processing activities they own or are involved in within the Process Register
- Tasks: Number of compliance tasks currently assigned to them in Task Management
- Risks: Number of risk register entries they are responsible for in Risk Management
- Impact Assessments: Number of DPIAs or other assessments they participate in
Click on any team member to view the full details of their assignments and ownership across all modules.
Filtering and Exporting
Use the search bar to find members by name or email address. Apply Filters to narrow the view by role or department. Click Export to download the full member list for audit documentation, HR reporting, or access review purposes.
Compliance Accountability Audit Trail
The platform automatically tracks all member-related actions with timestamps — providing a complete, chronological record of who was responsible for what at any point in time:
- When a member was added to or removed from the organization
- Role changes and permission updates
- Task assignments, completions, and reassignments
- Process and risk ownership changes
This audit trail directly supports GDPR accountability requirements under Article 5(2) — demonstrating that named individuals were responsible for specific compliance obligations at each point in your program's history.
Members Module Best Practices
Follow the principle of least privilege
Assign each team member only the role and access level they need to perform their compliance responsibilities. Avoid assigning Owner or Admin roles to members who only need task-level access — reducing the risk of accidental or unauthorized changes to compliance records.
Review member roles quarterly
Team responsibilities change frequently. A quarterly review of all member roles and assignments ensures access levels still reflect current job functions — and identifies any members who may need their access updated or removed.
Remove access promptly when team members leave
Departing team members should have their access removed immediately — and their open tasks, risks, and process ownerships reassigned to active team members. Unowned compliance items create accountability gaps that may not be visible until a regulatory audit.
Use role-based workflow approvers
Configure approvers in Workflow & Automation by role rather than by named individual wherever possible. This ensures workflows continue functioning correctly when team members change roles or leave the organization — without requiring manual reconfiguration of approval chains.
Assign ownership to every item
Every process, system, risk, and task in the Governance Solution should have a clearly named owner. Unowned items reduce accountability, lower maturity scores across multiple dimensions, and create gaps that supervisory authorities may identify during regulatory inspections.
Next Steps
- Assign team members as owners of processing activities in the Process Register
- Set up and assign compliance tasks in Task Management to ensure clear accountability for all open actions
- Configure role-based approvers in Workflow & Automation to future-proof your approval chains against team changes
Frequently Asked Questions
What happens to tasks and risks owned by a member when they are removed?
When a team member is removed from the organization, their tasks, risks, and process ownerships remain in the system but become unassigned. An administrator should reassign all open items to active team members promptly after removal to prevent accountability gaps and ensure compliance activities continue without interruption.
Can the same person hold multiple roles across different modules?
Each team member has a single platform role — Owner, Admin, or Member — that governs their access level across the Governance Solution. However, a single team member can be assigned ownership of multiple processes, tasks, risks, and assessments simultaneously, regardless of their platform role.
Is the member audit trail accessible to supervisory authorities?
The audit trail is an internal record within the Governance Solution. If required during a regulatory inspection, administrators can export member records and activity logs to demonstrate that named individuals held specific compliance responsibilities at particular points in time — supporting GDPR accountability documentation under Article 5(2).
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Compliance Automation – Automating Recurring GDPR Tasks, Workflows, and AI Suggestions in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/automating-recurring-compliance-tasks-governance-platform
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:56:00+00:00
Updated: 2026-03-22T15:54:56.476+00:00
Reading Time: 6 minutes
Summary: Automate recurring GDPR compliance tasks, configure event-triggered workflows, and use AI suggestions to close compliance gaps using Secure Privacy's Governance Solution.
Manual compliance tracking is time-consuming, error-prone, and difficult to scale as your privacy program grows. Secure Privacy's Governance Solution enables you to automate recurring compliance activities — from privacy policy reviews and risk register updates to DPIA follow-ups and system audits — so nothing falls through the cracks and your team can focus on higher-value compliance work.
Who Is This For?
- Compliance managers who want to reduce manual tracking overhead and ensure recurring obligations are never missed
- Privacy officers responsible for ensuring ongoing GDPR compliance activities happen on schedule across the organization
- Operations teams supporting compliance processes and managing task assignments at scale
What Compliance Activities Can Be Automated?
The Governance Solution supports automation across three categories of recurring compliance activity:
Recurring task creation
Set compliance tasks to automatically regenerate on a defined schedule — eliminating the need for manual re-creation of routine obligations:
- Privacy policy reviews — monthly or quarterly, depending on your regulatory environment
- Risk register updates — quarterly reviews of open and in-progress risk records
- DPIA reviews — annually or triggered when associated processing activities change
- System inventory audits — quarterly or semi-annually to identify new, changed, or decommissioned systems
- Training completion checks — annual verification that all staff have completed mandatory data protection training
Workflow-triggered tasks
Configure event-based workflows in the Workflow & Automation module that automatically create follow-up tasks when specific compliance events occur:
- A DPIA is completed and requires follow-up risk mitigation actions
- A risk assessment identifies a new high-risk item requiring immediate remediation
- A system review reveals missing privacy or security controls
- A compliance document expires and requires renewal or review
AI-generated compliance suggestions
The platform's AI capabilities proactively surface compliance gaps and recommended actions based on your data processing activities and program status:
- Assessments that may be required based on new or changed processing activities
- Policy reviews prompted by relevant regulatory changes or supervisory authority guidance
- Risk mitigation strategies based on industry patterns and your current risk profile
- Missing information or documentation gaps in your compliance program
Compliance Automation Setup
Step 1: Identify recurring compliance activities
List all compliance activities that occur on a regular schedule — including reviews, audits, training cycles, and deadline-driven regulatory obligations. This inventory forms the basis of your automation configuration.
Step 2: Create recurring tasks in the Compliance Calendar
In the Compliance Calendar, create tasks with recurrence settings configured. Specify the frequency, start date, and assignee for each recurring activity — and set smart reminders with appropriate lead times based on task priority and complexity.
Step 3: Configure event-triggered workflows
In Workflow & Automation, build workflows that create tasks automatically based on platform events. For example, configure a workflow that assigns a risk mitigation task to the relevant system owner whenever a new High-risk item is added to the risk register.
Step 4: Enable smart reminders
Configure notification settings to send deadline reminders to assignees as tasks approach their due dates. Set different lead times based on task type — allowing more preparation time for complex compliance activities such as DPIA reviews or annual audits.
Measuring Compliance Automation Impact
Track the effectiveness of your automation setup through Reporting & Analytics:
- Task completion rates over time — identifying whether automation is improving follow-through on recurring obligations
- Average response times for recurring compliance activities — measuring whether deadlines are being met consistently
- Overdue task trends — flagging areas where automation settings or assignee coverage may need adjustment
- Time saved compared to manual tracking — demonstrating the operational value of the automation program to leadership
Compliance Automation Best Practices
Start with your most frequent and most critical recurring tasks
Begin by automating the compliance activities that occur most often or carry the highest regulatory risk if missed — such as DSAR response deadlines, breach notification windows, and quarterly risk reviews. Add lower-frequency activities progressively.
Review automation settings quarterly
Compliance requirements evolve — new regulations, organizational changes, and updated processing activities can all affect which tasks need to be automated and at what frequency. Review your automation configuration quarterly to ensure it still reflects your current compliance obligations.
Treat AI suggestions as a starting point, not a final answer
AI-generated compliance suggestions are valuable for identifying gaps and prompting reviews — but they should always be reviewed by a qualified compliance professional before action is taken. Use them to augment your team's judgment, not replace it.
Monitor task completion rates actively
Automation creates tasks — but it cannot guarantee they are completed. Monitor completion rates through Reporting & Analytics and address low completion rates quickly, whether by adjusting assignees, lead times, or escalation settings in the workflow configuration.
Keep assignees current as team members change roles
When team members change roles or leave the organization, review all recurring tasks and workflow assignments to ensure they are reassigned promptly. Unowned automated tasks are one of the most common sources of missed compliance deadlines.
Next Steps
- Set up your first recurring compliance task in the Compliance Calendar — starting with your most frequent regulatory obligation
- Create an event-triggered workflow in Workflow & Automation to automate follow-up task assignment for high-risk items
- Review automation effectiveness and task completion rates in Reporting & Analytics after your first full compliance cycle
Frequently Asked Questions
Can automation be configured to trigger tasks based on GDPR-specific deadlines such as DSAR response windows?
Yes. DSAR response deadlines and other GDPR-mandated timeframes can be managed through the DSAR module and surfaced in the Compliance Calendar — with automated task creation and smart reminders ensuring your team is notified well in advance of regulatory deadlines. Workflow triggers can also create escalation tasks if a DSAR approaches its deadline without being resolved.
What happens to automated tasks if an assignee leaves the organization?
Automated tasks assigned to a departed team member will continue to be created on schedule but will remain unassigned or assigned to an inactive account until manually updated. It is important to review all recurring task and workflow assignments whenever a team member changes roles or leaves — your account administrator can reassign tasks in bulk through the Task Management module.
How does the AI suggestion feature differ from workflow automation?
Workflow automation is rule-based — it triggers specific, predefined tasks when configured conditions are met. AI suggestions are proactive and advisory — the platform analyses your compliance data and surfaces recommended actions, potential gaps, or upcoming obligations based on patterns in your program. Both are complementary: workflows handle known, recurring obligations automatically, while AI suggestions help identify what you may not yet know you need to address.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Document Repository – Secure Compliance Document Storage, Version Control, and Audit Logging in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/using-document-repository-centralize-compliance-documents
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:56:00+00:00
Updated: 2026-03-22T15:52:57.294+00:00
Reading Time: 5 minutes
Summary: Store, version-control, and audit all compliance documents — including DPAs, privacy policies, and DPIA records — using the Document Repository in Secure Privacy's Governance Solution.
The Document Repository in Secure Privacy's Governance Solution provides a centralized, secure location for storing all compliance-critical documentation — including privacy policies, Data Processing Agreements, vendor contracts, DPIA records, and audit evidence. Version control, granular permission management, and full audit logging ensure complete accountability and regulatory audit readiness at all times.
Who Is This For?
- Compliance teams maintaining policy and procedure libraries with version histories for regulatory accountability
- Legal teams managing contracts, Data Processing Agreements, and data protection clauses
- Auditors who need controlled access to supporting compliance documentation and evidence packages
Accessing the Document Repository
From the left sidebar in the Governance Solution, navigate to Data Management > Documents. The main view displays all documents in a searchable, sortable table.
Uploading a Compliance Document
Step 1: Click + Upload Document
Click the + Upload Document button in the top-right corner of the Document Repository view.
Step 2: Fill in document details
Complete the following fields to ensure the document is properly categorized and retrievable:
Field
Description
Example
Document Name
Clear, descriptive title following your organization's naming convention
"Service Contract - Vendor A"
Description
Brief description of the document's purpose and scope
"Service Contract Template with GDPR data protection clauses"
Department
The department that owns or is primarily responsible for the document
Legal, Privacy, IT
File
The document file to upload
service-contract.pdf, dpa-vendor-a.docx
Step 3: Set permissions
Configure who can view, edit, and download the document. Permissions can be set at the individual user or team level — ensuring sensitive compliance documents are only accessible to authorized personnel.
Compliance Document Management Features
Version control
Every document update creates a new version automatically. The complete version history is retained — allowing you to view how a document has changed over time and revert to a previous version if needed. This is critical for demonstrating compliance history to supervisory authorities and auditors, particularly for privacy policies and Data Processing Agreements.
Search and filtering
Use the search bar to find documents by name. Apply filters by department, document type, or date range to quickly locate specific files within a large compliance document library.
Audit logging
All document actions are automatically logged — including uploads, downloads, edits, permission changes, and deletions. This provides a complete, timestamped trail of who accessed or modified each document and when — supporting GDPR accountability under Article 5(2).
Export
Click Export to download a summary of your document library, including metadata and version information — useful for audit submissions, regulatory reporting, and internal governance reviews.
GDPR Compliance Document Types
The Document Repository is designed to store the full range of compliance documentation your organization needs to maintain and demonstrate GDPR compliance:
- Privacy policies and their complete revision history
- Data Processing Agreements (DPAs) with vendors and processors
- Service contracts containing data protection and confidentiality clauses
- Internal compliance procedures and operational guidelines
- Training materials and staff completion records
- Audit reports and evidence packages
- DPIA documentation and approval records from the Impact Assessments module
Document Repository Best Practices
Establish a consistent naming convention
A clear, consistently applied naming convention — including document type, subject, and date — makes the repository searchable and audit-ready as it grows. Define and document your naming standard before uploading large volumes of existing documents.
Review and update documents at least annually
Compliance documents — particularly privacy policies, DPAs, and internal procedures — should be reviewed at least annually and updated whenever relevant regulations, processing activities, or vendor relationships change. Schedule review reminders in the Compliance Calendar to ensure nothing is missed.
Use department-level permissions
Configure permissions at the department level to ensure documents are only accessible to teams with a legitimate need — preventing unauthorized access to sensitive legal or compliance documentation while maintaining appropriate cross-team visibility.
Link documents to related processes, systems, and assessments
Connecting documents to their associated process records, system entries, and DPIA assessments in the Governance Solution creates end-to-end traceability — making it easy to locate supporting documentation for any compliance obligation during an audit or regulatory inspection.
Next Steps
- Upload your organization's key compliance documents — starting with privacy policies, DPAs, and internal procedures
- Link documents to their associated processes in the Process Register for full ROPA documentation traceability
- Set up annual document review reminders in the Compliance Calendar to keep your document library current
Frequently Asked Questions
Can the Document Repository be used to store DPIA approval records for regulatory purposes?
Yes. DPIA documentation and approval records exported from the Impact Assessments module can be stored in the Document Repository — creating a centralized, version-controlled archive of all completed DPIAs. This provides a single location for all GDPR Article 35 compliance evidence, accessible to auditors and supervisory authorities on request.
What file formats are supported for document uploads?
The Document Repository supports standard compliance document formats including PDF and DOCX. If you encounter an unsupported format during upload, convert the file to a supported format before uploading. Contact Secure Privacy support if you have specific format requirements not covered by the current supported list.
How does audit logging in the Document Repository support GDPR accountability?
Every document action — upload, download, edit, permission change, and deletion — is logged with a timestamp and the identity of the user who performed the action. This creates a complete, tamper-resistant record of document access and modification history, directly supporting GDPR accountability requirements under Article 5(2) and providing evidence for supervisory authority inspections.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Enterprise Security and Data Protection – AES-256 Encryption, SSO, Multi-Entity Support, and Audit Trail in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/governance-platform-data-security-encryption-enterprise
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:56:00+00:00
Updated: 2026-03-22T16:25:20.702+00:00
Reading Time: 5 minutes
Summary: Learn how Secure Privacy's Governance Solution protects compliance data with AES-256 encryption, SSO, role-based access control, GDPR data residency, and a comprehensive platform-wide audit trail.
Secure Privacy's Governance Solution is built with enterprise-grade security at every layer — protecting your compliance data with AES-256 encryption, role-based access controls, SSO integration, and a comprehensive audit trail. This article covers the platform's security architecture, data protection measures, multi-entity support, and enterprise deployment features for IT security, procurement, and compliance teams.
Who Is This For?
- IT security teams evaluating the platform's security posture before enterprise deployment
- Procurement and legal teams assessing data protection measures and SLA commitments
- Compliance officers verifying that the platform's security architecture meets GDPR and internal governance requirements
AES-256 Data Encryption
All data stored and transmitted within the Governance Solution is protected with AES-256 encryption — the same standard used by financial institutions and government organizations:
Encryption at rest
All stored compliance data, documents, and attachments are encrypted using AES-256 — ensuring that data stored on the platform's infrastructure cannot be read even if physical storage is compromised.
Encryption in transit
All communications between users and the platform use TLS 1.2+ encryption — protecting data as it moves between browsers, APIs, and the platform's servers.
Backup encryption
All backup copies of platform data are encrypted to the same AES-256 standard as live data — ensuring backup archives cannot be accessed without authorization.
Multi-Entity Support
The Governance Solution supports complex organizational structures — allowing enterprise customers to manage multiple entities, subsidiaries, or regional operations from a single centralized account:
- Manage separate compliance programs for each entity within a single platform instance
- Compare privacy maturity scores and risk levels across all entities
- Generate consolidated reports for the full organization or entity-specific reports for individual business units
GDPR Data Residency
Enterprise customers can specify data residency requirements to ensure compliance data is stored in the appropriate geographic region. This is particularly important for organizations subject to GDPR's data localization requirements or other regional data protection regulations that restrict where personal data and compliance records may be hosted. Contact your account manager to configure data residency for your organization.
Enterprise SSO and Role-Based Access Control
The platform enforces strict, layered access controls to ensure each team member can only access the compliance data relevant to their role:
Three-tier role system
Owner, Admin, and Member roles provide distinct access levels — from full platform and settings control at the Owner level to scoped task and module access at the Member level. See the Members module documentation for full role definitions.
Granular module and document permissions
Permissions can be configured at the individual module and document level — allowing fine-grained control over who can view, edit, or download specific compliance records within each module.
Single Sign-On (SSO) integration
The platform supports SSO integration with your existing identity provider — enabling centralized authentication management, enforcing your organization's password and MFA policies, and simplifying user provisioning and deprovisioning.
Audit logging of all access and permission changes
All access events, permission updates, and role changes are recorded in the platform's audit trail — providing a timestamped record of who had access to what and when.
Enterprise SLAs and Dedicated Support
Enterprise plans include a structured support and success package designed for organizations with critical compliance infrastructure requirements:
- Dedicated support with guaranteed response times under a custom Service Level Agreement
- Custom SLAs tailored to your organization's operational and regulatory requirements
- Priority access to new platform features and updates before general release
- Dedicated customer success manager for ongoing strategic guidance and issue escalation
Enterprise Onboarding and Training
Enterprise customers receive a structured onboarding and training program to ensure effective platform adoption across all user roles:
- Guided onboarding with a dedicated implementation specialist covering configuration, data migration, and initial compliance program setup
- Custom training programs tailored to different user roles — from platform administrators to module-level contributors
- Access to documentation, video tutorials, and best practice guides
- Ongoing training support as new features and modules are released
Custom Integrations
The Governance Solution supports custom integrations to connect with your organization's existing tools and enterprise systems. Common integration scenarios include:
- SSO and identity provider integration — connect with Microsoft Entra ID, Okta, or other enterprise identity providers
- Ticketing system integration — connect DSAR workflows to your existing service desk or ticketing tools
- Document management synchronization — integrate with existing document management systems for centralized file control
- Business intelligence export — export compliance reporting data to BI tools for custom dashboards and executive reporting
Platform-Wide Compliance Audit Trail
Every action performed in the Governance Solution is recorded in a comprehensive, tamper-resistant audit trail — providing complete visibility into all platform activity for internal governance and regulatory review:
- User login and session activity
- Data access and record modification events
- Permission and role changes
- Document uploads, downloads, and edits
- Workflow approvals, rejections, and escalations
Next Steps
- Contact your account manager to discuss enterprise features, data residency configuration, and custom SLA options
- Review the Members module to configure role-based access controls for your organization
- Set up multi-entity management if your organization manages multiple subsidiaries or regional entities
Frequently Asked Questions
Is the Governance Solution compliant with GDPR data residency requirements?
Yes. Enterprise customers can configure data residency to ensure compliance data is stored in the appropriate geographic region — supporting GDPR requirements for organizations that need data hosted within the EU or EEA. Contact your account manager to configure data residency for your deployment.
Does the platform support SSO with Microsoft Entra ID or other enterprise identity providers?
Yes. The Governance Solution supports SSO integration with major enterprise identity providers. SSO enables centralized authentication, enforces your organization's existing MFA and password policies, and simplifies user lifecycle management — including automatic deprovisioning when team members leave. Contact your account manager for integration setup guidance.
Can the audit trail be exported for supervisory authority inspections?
Yes. Platform audit trail records can be exported and presented to supervisory authorities as evidence of GDPR accountability — demonstrating who performed specific compliance actions, when access was granted or revoked, and how compliance records were managed over time. This directly supports Article 5(2) accountability obligations.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Impact Assessments Module – GDPR Article 35 DPIA Workflow, Risk Identification, and Approval Management in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/how-to-conduct-dpia-impact-assessments-module
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:53:00+00:00
Updated: 2026-03-22T11:55:07.396+00:00
Reading Time: 5 minutes
Summary: Complete GDPR Article 35 DPIAs using the Impact Assessments module in Secure Privacy's Governance Solution — with structured risk identification, mitigation tracking, approval workflows, and audit-ready exports.
The Impact Assessments module in Secure Privacy's Governance Solution provides a structured workflow for completing Data Protection Impact Assessments (DPIAs) as required under GDPR Article 35. It guides your team through risk identification, mitigation documentation, and multi-step approval — producing audit-ready DPIA records for regulators, auditors, and internal stakeholders.
Who Is This For?
- Data Protection Officers responsible for conducting and signing off on impact assessments under GDPR Article 35
- Compliance teams ensuring DPIA requirements are identified and fulfilled before high-risk processing begins
- Project managers launching new products, services, or systems that involve personal data processing
GDPR DPIA Requirements: When Is a DPIA Required?
Under GDPR Article 35, a DPIA is mandatory when processing is likely to result in a high risk to individuals' rights and freedoms. This includes processing that involves:
- Systematic and extensive profiling with significant effects on individuals
- Large-scale processing of special category data or criminal offense data
- Systematic monitoring of publicly accessible areas on a large scale
- Use of new technologies that may introduce unforeseen privacy risks
- Automated decision-making — including profiling — that produces legal or similarly significant effects on individuals
Creating a New DPIA Assessment
Step 1: Navigate to Impact Assessments
From the left sidebar in the Governance Solution, go to Compliance > Impact Assessments and click + New Assessment.
Step 2: Select the assessment type
Choose the type of assessment — DPIA or another privacy assessment type supported by the platform — based on the nature of the processing activity being reviewed.
Step 3: Complete the DPIA assessment form
The structured form guides you through all required GDPR Article 35(7) fields:
Field
Description
Assessment Name
A descriptive title identifying the processing activity or project being assessed
Risk Level
Automatically calculated based on your answers — Low, Medium, or High
Status
Current stage of the assessment — Draft, Pending Approval, Approved, or Rejected
Data Categories
Types of personal data involved in the processing activity (e.g., Personal Data, Location Data, Special Category Data)
Last Review
Date of the most recent review — used to track when the DPIA is due for reassessment
Step 4: Risk identification and mitigation
The platform automatically identifies potential risk areas based on the data categories and processing activities you describe. Review each flagged risk, document your mitigation measures, and record the controls being implemented — satisfying the mitigation documentation requirements of GDPR Article 35(7)(d).
Step 5: Submit for approval
Once complete, submit the assessment for approval. If a Workflow is configured for impact assessments, the DPIA will automatically route through the required approval chain — ensuring the DPO and any other required approvers review and sign off before processing begins.
Managing DPIA Records
Searching and filtering
Use the search bar and Filters to find assessments by name, type, risk level, status, or data categories — keeping your impact assessment register navigable as it grows.
Exporting assessments
Click Export to download assessment records in a format suitable for submission to supervisory authorities, sharing with auditors, or inclusion in internal compliance documentation.
Version history
All assessment changes are tracked with versioned records. View the full history of any DPIA to see how it has evolved — providing a complete audit trail of the assessment process from initial draft to final approval.
DPIA Best Practices
Conduct DPIAs before high-risk processing begins
GDPR Article 35 requires DPIAs to be completed before the processing activity starts — not retrospectively. Use the pre-screening trigger in the module to identify when a new project or system requires a DPIA as early as the planning stage.
Involve stakeholders early
Bring in IT, legal, and the DPO from the outset — not just at the approval stage. Early involvement ensures the DPIA reflects technical realities and that mitigation measures are feasible before design decisions are finalized.
Document all mitigation measures and track implementation
Every identified risk must be accompanied by documented mitigation measures. Link DPIA mitigation actions to the Risk Management module to ensure they are tracked to completion — not just recorded and forgotten.
Schedule regular DPIA reviews
DPIAs must be revisited when the associated processing activity changes. Schedule periodic reviews in the Compliance Calendar — particularly for long-running processing activities where technology, data categories, or risk profiles may evolve over time.
Use workflow automation for consistent approval processes
Configure the Workflow & Automation module with the Impact Assessment Approval template to enforce a consistent, documented review and sign-off process for every DPIA — eliminating ad hoc approval practices and ensuring audit trail completeness.
Next Steps
- Link DPIA results to the Risk Management module for ongoing risk monitoring and mitigation tracking
- Set up the Impact Assessment Approval workflow in Workflow & Automation to enforce structured DPIA review chains
- Schedule periodic DPIA reviews in the Compliance Calendar to ensure assessments remain current as processing activities evolve
Frequently Asked Questions
Does the Impact Assessments module satisfy GDPR Article 35(7) documentation requirements?
Yes. The structured assessment form captures all fields required under GDPR Article 35(7) — including a systematic description of the processing, a necessity and proportionality assessment, risk identification, and mitigation measures. Completed assessments can be exported in audit-ready format for supervisory authority submission or regulatory review.
What happens if a DPIA identifies a high residual risk that cannot be mitigated?
If residual risk remains high after mitigation measures are applied, GDPR Article 36 requires prior consultation with the supervisory authority before processing begins. Your DPO should be notified immediately — and if you are using Secure Privacy's DPO as a Service, your assigned DPO will advise on whether prior consultation is required and manage the process.
Can DPIAs created in the module be linked to specific processing activities in the Process Register?
Yes. Impact assessments can be linked to related process records in the Process Register module, creating end-to-end traceability from the processing activity documented in your ROPA through to its associated DPIA — supporting comprehensive GDPR accountability documentation.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Applications & Systems Module – GDPR System Inventory, Risk Scoring, and Data Flow Visibility in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/managing-data-systems-owners-governance-platform
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:53:00+00:00
Updated: 2026-03-22T11:57:57.332+00:00
Reading Time: 4 minutes
Summary: Maintain a live GDPR system inventory, assign owners, track privacy controls, and monitor risk scores using the Applications & Systems module in Secure Privacy's Governance Solution.
The Applications & Systems module in Secure Privacy's Governance Solution gives your organization clear, real-time visibility into every system, application, and infrastructure component that processes personal data. Maintain a live system inventory, assign ownership, track privacy controls, and monitor risk scores — supporting GDPR Article 30 ROPA requirements and ongoing privacy and security governance.
Who Is This For?
- IT administrators maintaining a complete inventory of all systems that process personal data across the organization
- Privacy officers tracking which systems handle sensitive or special category information and their associated compliance status
- Security teams monitoring system risk levels, privacy controls, and compliance review history
Accessing the Systems Module
From the left sidebar in the Governance Solution, navigate to Data Management > Systems. The main view displays a filterable, searchable table of all registered systems.
Building Your GDPR System Inventory
Manual entry
Click + Add System and complete the system record with the following fields:
Field
Description
Example
Name
System or application name
"Salesforce CRM"
Category
Type of system
CRM, Analytics, HR, Cloud Storage
Type
System deployment classification
SaaS, On-Premise, Hybrid
Status
Current operational status of the system
Active, Under Review, Decommissioned
Launch Date
Date the system was deployed or activated
2024-01-15
Impact
Privacy impact level of the system
High, Medium, Low
Data Types
Categories of personal data processed by the system
Contact Info, Financial, Health
Privacy Controls
Technical controls currently in place for the system
Encryption, Access Control, DLP
Bulk import
Click Import to upload multiple systems at once from a structured file. This is the recommended approach when migrating an existing system inventory from spreadsheets or other compliance tools.
System Owner Assignment
Every system should have a designated owner responsible for maintaining its compliance status and responding to privacy and security obligations. Assign owners from your organization's member list in the Members module. System owners automatically receive notifications about:
- Upcoming review dates for their assigned systems
- New risks linked to their systems in the Risk Management module
- Tasks assigned to them in relation to their systems
System Risk Scoring
The Governance Solution generates a system-specific risk score for each registered system, calculated based on:
- Types and sensitivity of personal data processed by the system
- Privacy and security controls currently in place
- Number and severity of risks linked to the system in the Risk Management module
- Compliance status and review history — including how recently the system was last assessed
Filtering and Exporting the System Inventory
Use Filters to narrow the system inventory view by category, type, status, impact level, or data types. Click Export to download the full system inventory for audit submissions, regulatory reporting, or ROPA documentation purposes.
System Inventory Best Practices
Register all systems that process personal data — including third-party SaaS tools
Many GDPR compliance gaps originate from unregistered third-party applications. Ensure every SaaS tool, cloud service, and on-premise application that touches personal data is recorded in the inventory — including marketing platforms, HR systems, and analytics tools.
Review the system inventory quarterly
Systems are regularly added, changed, or decommissioned. A quarterly inventory review identifies new systems that have not yet been registered and flags decommissioned systems whose records should be updated — keeping your ROPA accurate and current.
Assign clear ownership for every system
Unowned systems create compliance blind spots. Every system in the inventory should have a named owner who is responsible for its review schedule, risk monitoring, and task completion — ensuring accountability is never ambiguous.
Link systems to related processes in the Process Register
Connecting system records to their associated processing activities in the Process Register creates end-to-end data flow visibility — from the system processing personal data through to the documented processing activity in your ROPA, and any linked risk assessments or DPIAs.
Next Steps
- Link registered systems to processing activities in the Process Register for full ROPA traceability
- Track system-specific privacy and security risks in the Risk Management module
- Review system inventory status and risk distribution through Reporting & Analytics
Frequently Asked Questions
Does the system inventory support GDPR Article 30 ROPA requirements?
Yes. The Applications & Systems module captures the system-level detail that underpins an accurate Record of Processing Activities — including data categories processed, privacy controls in place, and system ownership. Linking system records to process entries in the Process Register creates the complete, structured ROPA documentation required under GDPR Article 30.
What is the difference between the Systems module and the Process Register?
The Systems module inventories the technical systems and applications that process personal data — capturing what the system is, who owns it, what data it handles, and what controls are in place. The Process Register documents the processing activities themselves — the purpose, lawful basis, data categories, and retention periods. The two modules complement each other: systems feed into processes, and together they form a complete ROPA.
Can the system risk score be used to prioritize DPIA pre-screening?
Yes. Systems with high impact ratings and elevated risk scores are strong candidates for DPIA pre-screening under GDPR Article 35. Your DPO can use the system risk score alongside the data categories and privacy controls recorded in the inventory to determine whether a full DPIA is required before or during a system's deployment or significant change.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Risk Management Module – GDPR Privacy Risk Register, Automated Scoring, and Mitigation Tracking in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/risk-management-identifying-scoring-mitigating-privacy-risks
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:53:00+00:00
Updated: 2026-03-22T12:18:52.344+00:00
Reading Time: 5 minutes
Summary: Build and maintain a GDPR privacy risk register using the Risk Management module in Secure Privacy's Governance Solution — with automated risk scoring, heat map visualization, AI analysis, and mitigation tracking.
The Risk Management module in Secure Privacy's Governance Solution helps your organization continuously identify, prioritize, and mitigate privacy risks across all data processing activities. Using an automated likelihood-impact scoring model, it surfaces your highest-priority risks, supports mitigation planning, and provides visual risk dashboards — enabling compliance teams to maintain a structured, audit-ready privacy risk register aligned with GDPR requirements.
Who Is This For?
- Risk managers building and maintaining a privacy risk register across the organization
- Compliance officers tracking risk exposure, remediation status, and overall risk posture
- IT and security teams monitoring system-specific risks and the effectiveness of technical controls
Accessing Risk Management
From the left sidebar in the Governance Solution, navigate to Compliance > Risks. The module offers two views: List View for managing individual risk records, and Charts for visual risk analysis.
Building Your GDPR Privacy Risk Register
Step 1: Click + Add Risk
Click the + Add Risk button in the top-right corner of the Risk Management view.
Step 2: Define the risk
Complete the risk record with the following fields:
Field
Description
Example
Name
Clear, descriptive title for the risk
"Non-Compliance with GDPR Article 13 Transparency Requirements"
Department
The department where the risk originates or is managed
Legal, IT, Marketing
Type
Classification of the risk by source
Process, Vendor, System
Risk Level
Severity level calculated by the automated scoring model
High Risk, Medium Risk, Low Risk
Status
Current state of the risk
Open, In Review, Mitigated, Closed
Risk Factors
Specific contributing factors that increase the risk likelihood or impact
"Outdated privacy policy", "Lack of employee training"
Step 3: Link to related items
Connect the risk to related systems, processing activities, and owners. This creates end-to-end traceability across your compliance program — from the identified risk through to the system or process that generates it and the team member responsible for remediation.
Automated Risk Scoring Model
The platform automatically calculates a risk score based on two inputs:
- Likelihood: How probable is it that the risk event will occur?
- Impact: How severe would the consequences be for individuals' rights and freedoms or for the organization?
The combined score determines the overall risk level — High, Medium, or Low — and is used to prioritize remediation efforts and flag items that may require DPIA pre-screening under GDPR Article 35.
Risk Visualization and Heat Map
Switch to the Charts view for visual risk analysis across your organization:
- Risk Heat Map: A visual distribution of all risks plotted by likelihood and impact — immediately showing where the highest concentrations of risk sit.
- Risk by Department: A breakdown of risk exposure across teams and departments — supporting targeted remediation and management reporting.
- Risk by Type: Distribution of risks across Process, Vendor, and System categories — identifying which risk sources require the most attention.
- Trend Analysis: A view of how your overall risk posture is changing over time — demonstrating risk reduction progress to leadership and regulators.
AI-Powered Risk Analysis
Click the AI Analysis button to receive intelligent, data-driven suggestions about your risk register:
- Risks that may need immediate attention based on score and status
- Patterns and correlations across your risk register that may not be immediately visible
- Recommended mitigation strategies based on industry best practices
- Gaps in your current risk coverage that may leave compliance areas unmonitored
Mitigation Planning and Tracking
Document mitigation activities
For each identified risk, document the specific mitigation measures planned or already implemented — providing a written record of your organization's response to each privacy risk.
Assign mitigation tasks to team members
Link mitigation actions to named team members in the Task Management module, ensuring clear accountability for who is responsible for implementing each control.
Set deadlines and track progress
Assign target completion dates for each mitigation activity and monitor progress in real time — with overdue items flagged automatically in the risk register.
Monitor risk level changes as mitigations are implemented
As mitigation measures are completed, the risk score updates to reflect the reduced likelihood or impact — providing a live view of how your remediation efforts are improving your overall risk posture.
Troubleshooting
Risk score not updating
Ensure that both the Likelihood and Impact values have been set for the risk. The scoring model requires both inputs to calculate the overall risk level — leaving either field blank will prevent the score from generating.
Cannot link risk to a process
Verify that the process exists in the Process Register and has been saved. The Risk Management module can only link to process records that have been fully created in the Process Register. If the process is missing, create it there first.
Next Steps
- Link high-risk items to Impact Assessments to determine whether a DPIA is required under GDPR Article 35
- Create mitigation tasks directly in Task Management with assigned owners and deadlines
- Schedule periodic risk reviews using the Compliance Calendar to keep your risk register current
- Monitor risk trends and distribution through Reporting & Analytics for board and regulatory reporting
Frequently Asked Questions
How does the Risk Management module support GDPR DPIA pre-screening?
Risk records with High risk scores — particularly those linked to special category data, large-scale processing, or systematic monitoring — are strong indicators that a DPIA may be required under GDPR Article 35. Your DPO can use the risk register alongside the system inventory and process records to conduct a structured DPIA pre-screening assessment and document the reasoning.
Can risks be automatically generated from other modules?
Yes. Risks can be triggered automatically through the Workflow & Automation module — for example, when a new system is added with a High impact rating, or when a process record identifies special category data without a documented Article 9(2) condition. This reduces manual risk identification effort and ensures emerging risks are captured promptly.
How should the risk register be maintained for regulatory audit purposes?
The risk register should be reviewed and updated regularly — at minimum quarterly, and whenever processing activities or systems change significantly. All risk records, status changes, and mitigation updates are logged with timestamps in the audit trail, providing a complete, chronological record of your organization's privacy risk management activity for supervisory authority review.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Task Management Module – Compliance Task Tracking, Automated Assignment, and Audit Trails in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/how-to-use-task-management-governance-platform
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:52:00+00:00
Updated: 2026-03-22T11:52:06.429+00:00
Reading Time: 4 minutes
Summary: Assign, track, and audit compliance tasks across departments using the Task Management module in Secure Privacy's Governance Solution — with automated task creation, AI analysis, and full audit logging.
The Task Management module in Secure Privacy's Governance Solution helps your organization maintain accountability and avoid missed compliance actions across departments. Assign responsibilities, set due dates, link tasks to risks and processes, and monitor progress in real time — with a complete audit trail of all compliance activity for regulatory reporting and supervisory authority review.
Who Is This For?
- Compliance managers coordinating tasks and deadlines across multiple teams and departments
- Department heads tracking their team's compliance responsibilities and completion status
- Privacy officers maintaining audit-ready records of completed compliance actions for GDPR accountability
Accessing Task Management
From the left sidebar in the Governance Solution, navigate to Compliance > Tasks. The main view displays all tasks in a sortable, filterable table.
Compliance Task Creation
Step 1: Click + Add Task
Click the + Add Task button in the top-right corner of the Tasks view.
Step 2: Fill in task details
Complete the following fields to fully define the compliance task:
Field
Description
Example
Task Name
Clear description of the compliance action required
"Update Privacy Policy for Q2 changes"
Department
The department responsible for completing the task
Legal, Privacy, IT / Security
Priority
Urgency level of the task
High, Medium, Low
Status
Current state of the task
Pending, In Progress, Completed
Due Date
Deadline for task completion
2025-06-30
Assignee
The person or team responsible for completing the task
jane@company.com
Related To
Link the task to a process, system, or risk entry for end-to-end traceability
Customer Data Processing
Step 3: Save the task
Click Save. The task will appear in the task list and become immediately visible to the assigned team member.
Managing Compliance Tasks
Filtering and searching
Use the search bar to find tasks by name. Click Filters to narrow results by department, priority, status, or due date range — keeping the task list focused on what is most relevant to your current review.
Exporting tasks
Click the Export button to download your task list for compliance reporting, audit submissions, or sharing with leadership and stakeholders.
AI analysis
Click the AI Analysis button to receive AI-generated insights about your task priorities, overdue items, and areas of your compliance program that may need additional attention.
Automated Compliance Task Creation
Tasks can be created automatically through three trigger mechanisms — reducing manual overhead and ensuring compliance actions are never missed:
- Workflow triggers: When a step in the Workflow & Automation module is completed, the next task is automatically assigned to the relevant team member.
- Risk triggers: When a new risk is identified in the Risk Management module, related remediation tasks are automatically generated and assigned.
- Calendar deadlines: Recurring compliance tasks are automatically created based on the schedule configured in your Compliance Calendar.
Audit-Ready Task Trail
Every change to a task is logged with a timestamp — including creation, status updates, reassignments, and completion. This provides a complete, chronological audit history of all compliance activity across your organization, supporting GDPR accountability under Article 5(2) and providing documented evidence for regulatory inspections and internal audits.
Troubleshooting
Task not visible to assignee
Verify that the assigned team member has been added to the Members module and has the appropriate role permissions to view and interact with tasks. Contact your Secure Privacy account administrator if permissions need to be updated.
Cannot change task status
If the task is part of an active workflow, its status may be controlled by the workflow engine rather than edited manually. Check Workflow & Automation to confirm whether the task requires an approval step before it can be marked as complete.
Next Steps
- Set up Workflow & Automation to trigger task creation automatically based on approval workflows and compliance events
- Use the Compliance Calendar to visualize all upcoming task deadlines in a monthly view alongside other compliance obligations
- Link tasks to Risk Management entries to maintain full traceability from identified risk to assigned remediation action
Frequently Asked Questions
Can tasks be linked to specific GDPR compliance obligations such as DSARs or DPIAs?
Yes. The Related To field allows tasks to be linked to processes, systems, or risk entries across the Governance Solution — creating end-to-end traceability between a compliance obligation and the action taken to address it. For DSAR and DPIA workflows, tasks can also be generated automatically through the Workflow & Automation module.
Who can see tasks assigned to other team members?
The task list view is accessible to all team members with access to the Task Management module. Filtering by assignee allows managers and compliance officers to review the full task load and completion status for any individual or department — supporting oversight without requiring manual status updates.
How does the AI Analysis feature help with compliance task management?
The AI Analysis feature reviews your current task list and generates prioritization suggestions — identifying overdue items, highlighting areas with high task concentration, and flagging compliance program areas that may need additional attention. It is designed to support rather than replace your team's judgment on compliance priorities.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Compliance Calendar – Deadline Tracking, Recurring Tasks, and Cross-Module Integration in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/using-compliance-calendar-track-deadlines-tasks
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:52:00+00:00
Updated: 2026-03-22T11:41:25.503+00:00
Reading Time: 4 minutes
Summary: Track GDPR compliance deadlines, schedule recurring tasks, and get cross-module visibility into DSAR, DPIA, and risk review dates using the Compliance Calendar in Secure Privacy's Governance Solution.
The Compliance Calendar in Secure Privacy's Governance Solution gives your privacy and compliance team a visual, centralized overview of all upcoming regulatory deadlines, recurring tasks, and key compliance dates. By pulling due dates from across the platform — including DSAR deadlines, DPIA review schedules, and risk assessment dates — it keeps teams aligned on what needs to happen and when.
Who Is This For?
- Compliance managers tracking regulatory deadlines and recurring compliance obligations
- Team leads monitoring task due dates and assignments across their departments
- Privacy officers planning audit schedules, DPIA review cycles, and annual compliance activities
Accessing the Compliance Calendar
From the left sidebar in the Governance Solution, click Calendar. The calendar displays in monthly view by default, with navigation controls to move between months and years.
Adding and Viewing Tasks
Adding a task directly
Click + Add Task in the top-right corner, or click on any date cell to create a task for that specific day. Fill in the task details — including name, description, assignee, and priority level.
Viewing existing tasks
Tasks created in the Task Management module that have due dates assigned automatically appear on the calendar. Click any task to view its full details, update its status, or reassign it.
Recurring Compliance Tasks
Set up recurring tasks for compliance activities that occur on a regular schedule. The calendar automatically generates upcoming instances so they are always visible on the timeline:
- Monthly — privacy policy reviews and consent record checks
- Quarterly — risk assessments and executive compliance reporting
- Annual — DPIA reviews, annual compliance audits, and staff training cycles
- Custom intervals — organization-specific compliance activities at any frequency
Compliance Calendar Features
Smart reminders
Enable notifications to receive deadline reminders in advance. Configure the lead time — 1 day, 3 days, or 1 week — based on the task's priority and complexity to ensure nothing is missed.
Cross-module deadline integration
The Compliance Calendar automatically pulls due dates from across the Governance Solution, providing a unified view of all time-sensitive obligations:
- DSAR response deadlines from the DSAR module
- Risk review due dates from Risk Management
- DPIA review schedules from Impact Assessments
- Workflow escalation dates from Workflow & Automation
Team-wide visibility
All team members with access to the Governance Solution can view the shared calendar — giving the entire compliance team visibility into upcoming activities, preventing duplicate work, and improving cross-department coordination.
Compliance Calendar Best Practices
Review the calendar weekly
A weekly calendar review ensures your team stays ahead of approaching deadlines — particularly for GDPR obligations with fixed response windows such as DSAR replies and breach notifications.
Use recurring tasks for all standard compliance activities
Setting up recurring tasks for regular obligations — policy reviews, risk assessments, training cycles — eliminates manual tracking and ensures nothing drops off the schedule as team members change.
Set reminders with adequate lead time for high-priority items
For complex or high-priority compliance tasks, configure reminders at least one week in advance — allowing time to gather evidence, involve stakeholders, or escalate where needed before the deadline arrives.
Encourage team members to check their assigned tasks regularly
The calendar is most effective as a shared team tool. Encourage all team members to check their assigned tasks regularly and update status — keeping the calendar accurate as a live reflection of your compliance program's progress.
Next Steps
- Connect your tasks to Workflow & Automation for automatic deadline scheduling and escalation
- Set up recurring tasks for your organization's key regulatory deadlines and annual compliance review cycles
- Use Reporting & Analytics to review task completion rates and identify patterns in missed or delayed compliance activities
Frequently Asked Questions
Does the Compliance Calendar automatically show GDPR response deadlines such as DSAR windows?
Yes. The calendar integrates directly with the DSAR module, Risk Management, Impact Assessments, and Workflow & Automation modules — automatically surfacing their due dates on the calendar without manual entry. This ensures GDPR-mandated response windows are always visible alongside your internally scheduled compliance tasks.
Can recurring tasks be set to custom intervals rather than standard monthly or quarterly cycles?
Yes. In addition to standard recurring intervals — monthly, quarterly, and annual — the calendar supports custom recurrence settings for organization-specific compliance activities that do not follow a standard schedule.
Who can see the tasks on the shared calendar?
All team members with access to the Governance Solution can view the shared compliance calendar. Task visibility is governed by the permissions assigned to each user — ensuring sensitive compliance activities are accessible only to the relevant team members while maintaining a shared overview of upcoming deadlines for the whole team.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Reporting & Analytics Module – GDPR Compliance Reports, Maturity Scoring, and Audit-Ready Exports in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/generating-reports-analytics-governance-platform
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:52:00+00:00
Updated: 2026-03-22T11:35:37.991+00:00
Reading Time: 4 minutes
Summary: Generate GDPR compliance dashboards, gap analysis reports, risk heat maps, and audit-ready PDF exports using the Reporting & Analytics module in Secure Privacy's Governance Solution.
The Reporting & Analytics module in Secure Privacy's Governance Solution turns your compliance data into actionable insights. Generate real-time compliance dashboards, compare privacy program maturity scores across entities, and export audit-ready reports for regulators, leadership, and stakeholders — all from a single centralized view.
Who Is This For?
- Compliance managers preparing GDPR compliance reports for leadership or supervisory authorities
- Privacy officers monitoring program maturity and risk status across multiple entities or organizations
- Executives and board members who need high-level visibility into organizational compliance status
Accessing the Reporting Module
From the left sidebar in the Governance Solution, navigate to Reports. The module provides three views: All Reports, Company Reports, and Cross-Company Analytics.
Available GDPR Compliance Reports
Company Reports
Report
Description
Compliance Dashboard
Comprehensive real-time overview of compliance status across all Governance Solution modules
Vendor Risk Assessment
Vendor risk scores, certifications, and third-party compliance status
DSAR Performance
Data subject request response times, completion rates, and request volume trends
System Inventory
Complete inventory of systems processing personal data, with privacy and security attributes
Gap Analysis
Identify missing controls, incomplete documentation, and compliance gaps requiring remediation
Risk Heat Map
Visual representation of privacy risk distribution across the organization by likelihood and severity
Executive Summary
High-level compliance overview formatted for leadership and board presentations
Cross-Company Analytics
Report
Description
Cross-Company Analytics
Aggregated compliance metrics and benchmarking across all organizations managed in the platform
Privacy Program Comparison
Side-by-side comparative privacy program assessment across multiple organizations or entities
Privacy Program Maturity Comparison Across Entities
For organizations managing multiple entities, the maturity comparison report provides a structured, visual comparison of compliance status across each entity:
- Overall compliance scores per entity
- Maturity level classification — Reactive, Developing, or Proactive
- Risk level indicators — High Risk, Medium Risk, or Low Risk
- Category-by-category breakdown across Governance, Policies, Data Inventory, Individual Rights, Security, and Risk Management
- Spider chart visualizations for quick side-by-side comparison
Audit-Ready Report Export
Click Export PDF on any report to generate a formatted, audit-ready document. All exported reports include:
- Timestamp of report generation
- Organization and entity details
- Full data tables and visualizations
- Compliance status indicators per module or category
Using Reports to Prepare for Regulatory Audits
When preparing for a supervisory authority inspection, regulatory audit, or internal compliance review, follow this recommended report sequence:
- Generate the Compliance Dashboard for a complete status summary across all modules.
- Export the Gap Analysis to demonstrate that identified compliance gaps are actively being addressed.
- Include the Risk Heat Map to show documented risk awareness and prioritization.
- Attach the Executive Summary as a management-level accountability overview.
Reporting Best Practices
Generate reports monthly
Monthly report generation allows your compliance team to track trends, identify emerging gaps, and demonstrate continuous improvement over time — building a documented compliance history.
Share the Executive Summary with leadership quarterly
Quarterly distribution of the Executive Summary to senior leadership and the board fulfils the DPO's reporting obligations under GDPR Article 39 and ensures data protection remains a board-level governance priority.
Use the Gap Analysis proactively
Run the Gap Analysis regularly — not just before audits — to identify and address compliance weaknesses before they become findings during a regulatory inspection.
Compare entities regularly if managing multiple organizations
Use the Privacy Program Comparison report to benchmark maturity levels across entities, identify outliers requiring additional attention, and standardize compliance practices across your organization portfolio.
Next Steps
- Generate your first report export and share it with your compliance team
- Use the Privacy Program Comparison to benchmark maturity scores across your entities
- Schedule regular report generation as a recurring task in the Calendar module to maintain a consistent compliance reporting cadence
Frequently Asked Questions
Can exported reports be used as evidence for supervisory authority submissions?
Yes. All exported PDFs include generation timestamps, organization details, full data tables, and compliance status indicators — providing a documented, audit-ready record of your organization's compliance status at a specific point in time. These reports are designed to support GDPR accountability obligations under Article 5(2) and can be submitted to supervisory authorities or shared with auditors.
What is the difference between Company Reports and Cross-Company Analytics?
Company Reports focus on a single organization's compliance status across all modules — covering areas such as DSAR performance, risk distribution, and gap analysis. Cross-Company Analytics provide aggregated metrics and side-by-side comparisons across multiple organizations or entities managed within the platform — designed for privacy officers or compliance managers overseeing more than one organization.
How often should the Compliance Dashboard be reviewed?
The Compliance Dashboard should be reviewed at minimum monthly to track program status and identify changes in risk or gap levels. It should also be reviewed ahead of any scheduled audit, board presentation, or significant change to data processing activities.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Workflow & Automation Module – Compliance Approval Workflows, Escalations, and Audit Trails in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/setting-up-workflow-automation-governance-platform
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-09T17:52:00+00:00
Updated: 2026-03-22T11:47:16.806+00:00
Reading Time: 5 minutes
Summary: Build compliance approval workflows, automate task assignments, and maintain audit trails using the Workflow & Automation module in Secure Privacy's Governance Solution.
The Workflow & Automation module in Secure Privacy's Governance Solution lets you delegate work, automate task assignments, and enforce structured approval chains across your compliance program. Build custom multi-step workflows that route tasks to the right people, trigger escalations automatically, and maintain a complete audit trail of all decisions — ensuring consistent, documented review processes for DPIAs, risk assessments, and policy changes.
Who Is This For?
- Compliance managers who need structured, auditable approval processes for DPIAs, risk reviews, and policy changes
- Team leads who want to automate task assignments, escalations, and deadline reminders
- Privacy officers who need to enforce consistent review processes across their team and ensure nothing is approved without the correct sign-off chain
Accessing Workflows
From the left sidebar in the Governance Solution, navigate to Automation > Workflows. The main view shows three tabs: Workflows, Assignments, and Approvals.
Creating a Compliance Workflow
Step 1: Create from scratch or use a template
Click + Create to build a workflow from scratch, or click Use Template to start from one of the pre-built compliance workflow templates:
- System Assignment Review — A two-step approval process for assigning team members to systems in the Systems module.
- Impact Assessment Approval — A multi-level approval workflow for DPIA and impact assessment sign-off.
- Process Activity Assignment — A simple workflow for assigning data processing activities to responsible team members.
Step 2: Configure workflow steps
Each workflow consists of one or more steps. Configure the following settings for each step:
Setting
Description
Step Name
A descriptive label for the step (e.g., "Manager Review", "Final Approval")
Step Type
Review, Approval, or Completion
Escalation (days)
Number of days before the step automatically escalates if not completed
Approvers
Select specific users or assign by role — owner, admin, or member
Require all approvers
Whether all selected approvers must approve, or whether one approval is sufficient to advance the step
Step 3: Set the "Applies To" scope
Choose what the workflow applies to: System, Assessment, or Process. This determines which module actions will automatically trigger the workflow.
Step 4: Activate the workflow
Toggle the workflow status to Active. The workflow will now trigger automatically when the relevant action occurs in the configured module.
Managing Assignments and Approvals
Assignments tab
View all current workflow assignments across your team — including who is responsible for each step and the current completion status. Use this view to monitor workflow progress and identify any steps that are overdue or blocked.
Approvals tab
Review all pending approval requests in one place. Approvers can accept or reject items directly from this view, with the option to add comments — keeping a clear record of the decision and its rationale.
Workflow Automation Features
- Automatic notifications: Team members receive alerts when a task or approval step requires their action — eliminating the need for manual follow-up.
- Escalation timers: If a step is not completed within the configured timeframe, it automatically escalates to the next approver or a designated manager.
- Smart reminders: The platform sends reminder notifications as deadlines approach, reducing the risk of steps being missed or delayed.
- Audit logging: Every workflow action — including approvals, rejections, and escalations — is recorded with a timestamp, providing a complete audit trail for compliance documentation.
Workflow Best Practices
Keep workflows simple to start
Begin with two to three steps and add complexity only when your team has identified a genuine need. Overly complex workflows increase the risk of bottlenecks and reduce adoption.
Set realistic escalation timers
Configure escalation periods based on your team's typical response time for each step type. Too short and approvers will feel pressured; too long and bottlenecks go undetected.
Use role-based approvers wherever possible
Assigning approvers by role — rather than by named individual — ensures workflows continue functioning correctly when team members change roles or leave the organization.
Review workflow performance regularly
Monitor how workflows are performing through the Assignments tab and Reporting & Analytics — identifying steps where approvals are consistently delayed or where escalations are being triggered frequently.
Troubleshooting
Workflow not triggering
Verify that the workflow status is set to Active and that the Applies To scope matches the module where you expect it to trigger. A workflow scoped to "Assessment" will not trigger on System or Process actions.
Approver not receiving notifications
Confirm that the approver has an active account within your Secure Privacy organization and that notification settings are enabled in their user profile. Contact your account administrator if the issue persists.
Next Steps
- Connect workflows to the Task Management module for automatic task creation on workflow completion
- Use the Impact Assessment Approval template with the DPIA Management module to enforce structured GDPR Article 35 review processes
- Monitor workflow activity and approval completion rates through Reporting & Analytics
Frequently Asked Questions
Can a workflow have different approvers for different steps?
Yes. Each step in a workflow is configured independently — including its approvers, step type, and escalation timer. This allows you to build multi-level approval chains where, for example, a manager reviews first and a DPO provides final sign-off in a subsequent step.
What happens when an escalation timer runs out?
When a step is not completed within the configured escalation period, the platform automatically escalates the task — notifying the next approver in the chain or a designated administrator, depending on your workflow configuration. All escalations are recorded in the audit log.
Can workflows be used to enforce DPIA approval processes under GDPR Article 35?
Yes. The Impact Assessment Approval template is specifically designed for DPIA workflows, supporting multi-level review and sign-off processes that ensure DPIAs are completed and approved before high-risk processing begins. Every approval step is logged, providing an auditable record of the DPIA review process.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Getting Started with Secure Privacy's Governance Solution – Initial Setup, Team Configuration, and Module Overview
URL: https://support.secureprivacy.ai/article/getting-started-with-privacy-governance-platform
Product: Privacy & AI Governance
Category: Getting Started
Published: 2026-03-09T17:52:00+00:00
Updated: 2026-03-22T16:48:31.899+00:00
Reading Time: 4 minutes
Summary: Set up Secure Privacy's Governance Solution in minutes — complete the Privacy Program wizard, invite team members, and configure GDPR compliance modules including ROPA, risk, DSAR, and DPIA management.
This guide walks you through the initial setup of Secure Privacy's Governance Solution — from completing the Privacy Program Setup wizard and inviting team members through to configuring your compliance modules. Follow these steps to move from onboarding to operational in minutes.
Who Is This For?
- Privacy officers and compliance managers setting up a new GDPR governance program
- IT administrators responsible for provisioning team access and configuring the platform
- Legal teams centralizing compliance workflows and documentation in a single platform
Prerequisites
- An active Secure Privacy account with a Governance Solution subscription
- Admin-level access to your organization's Secure Privacy dashboard
Step 1: Complete the Privacy Program Setup Wizard
When you first access the Governance Solution, you are guided through a Privacy Program Setup wizard. This intake process asks a series of questions about your organization to automatically generate a tailored compliance structure.
The wizard asks you to:
- Select your industry — SaaS, Healthcare, Financial Services, Education, and others
- Define your data environment and primary data processing activities
- Identify applicable regulations — GDPR, CCPA, HIPAA, and others
- Specify your organizational structure and team size
Based on your answers, the platform automatically generates:
- Process maps for your documented data processing activities
- A prioritized set of compliance tasks and deadlines
- Suggested risk assessments and impact evaluations for high-risk processing
- Recommended policies and documentation templates aligned to your regulatory context
Step 2: Invite Team Members and Assign Roles
Navigate to Members in the left sidebar and click + Add Member. Invite team members by email and assign the appropriate role:
Role
Permissions
Owner
Full platform access including billing management and user administration
Admin
Full access to all compliance modules — cannot manage billing or organization settings
Member
Access limited to assigned modules, tasks, and processes
Each team member can be linked to specific processes, systems, tasks, and documentation — establishing clear ownership and accountability across your compliance program from the outset.
Step 3: Review the Compliance Dashboard
The Dashboard provides a real-time overview of your privacy program status, including:
- Overall compliance score and privacy program maturity level
- Pending tasks and upcoming regulatory deadlines
- Open risks and their current severity levels
- Recent activity across all Governance Solution modules
Step 4: Configure Your Governance Solution Modules
The Governance Solution includes ten integrated compliance modules. Start with the modules most relevant to your current priorities — you can enable and configure additional modules at any time:
- Process Register: Document all data processing activities and maintain your GDPR Article 30 ROPA
- Risk Management: Identify, score, and mitigate privacy risks across processing activities
- Task Management: Assign, track, and automate compliance tasks across teams
- DSAR Handling: Manage data subject access requests with deadline tracking and audit logging
- DPIA Management: Conduct GDPR Article 35 Data Protection Impact Assessments with structured workflows
- Systems Management: Inventory all systems processing personal data and track data flows
- Document Repository: Centralize privacy policies, DPAs, and compliance documentation with version control
- Compliance Calendar: Track deadlines, schedule recurring tasks, and monitor upcoming obligations
- Reporting & Analytics: Generate compliance dashboards, maturity reports, and audit-ready exports
- Workflow & Automation: Build custom multi-step approval workflows and automate compliance task creation
Next Steps
- Add your first data processing activities in the Process Register to begin building your ROPA
- Set up your Compliance Calendar with key regulatory deadlines and recurring compliance tasks
- Run your first Risk Assessment to identify and prioritize your highest-risk processing activities
- Upload existing policies and DPAs to the Document Repository for centralized, version-controlled access
Frequently Asked Questions
How long does initial setup take?
The Privacy Program Setup wizard typically takes 10–20 minutes to complete, depending on the complexity of your organization's data processing environment. Once submitted, the platform automatically generates your initial compliance structure — including process maps, task lists, and policy templates — so you can begin working immediately after the wizard is complete.
Can modules be configured after the initial setup?
Yes. All ten Governance Solution modules can be configured and expanded at any time after initial setup. You are not required to configure every module during onboarding — start with your highest-priority compliance areas and add additional modules as your program matures.
What happens if I select the wrong industry or regulations during the setup wizard?
The compliance structure generated by the wizard can be adjusted at any time after setup — including adding or removing applicable regulations, updating your organizational structure, and modifying auto-generated process maps. Contact your account manager or Secure Privacy support if you need assistance restructuring your initial program configuration.
See Also
- How to Handle Data Subject Access Requests (DSARs)
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# GDPR Enforcement & Fines: How a Data Protection Officer Reduces Your Risk
URL: https://support.secureprivacy.ai/article/handling-regulatory-fines-enforcement-dpo-advisory
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T15:01:00+00:00
Updated: 2026-03-26T01:28:54.526+00:00
Reading Time: 6 minutes
Summary: Facing a GDPR investigation or fine? Learn how a Data Protection Officer reduces enforcement risk, manages breach notification, and coordinates your response.
A supervisory authority investigation doesn't start with a fine — it starts with a single unresolved complaint, an unreported breach, or a data subject request that slipped through the cracks. By the time enforcement proceedings begin, the organization is already reacting under pressure, and the factors that determine whether a fine reaches €20 million or 4% of annual global turnover are largely shaped by decisions made (or not made) long before the investigation opened.
Many organizations attempt to manage GDPR compliance through a patchwork of legal advice, internal spreadsheets, and annual policy reviews. That approach leaves dangerous gaps: breach notification deadlines are missed, accountability records are thin, and when a supervisory authority asks for evidence of your technical and organizational measures, there's little to show. The result is a compliance posture that looks reactive — exactly what regulators penalize most heavily.
A qualified Data Protection Officer (DPO) changes that equation. Whether in-house or through an outsourced DPO service, a dedicated DPO builds the proactive compliance programme that keeps enforcement at bay, and coordinates every element of your response if a supervisory authority does come knocking.
This article explains how GDPR enforcement works, how administrative fines are calculated under GDPR Article 83, and — most importantly — how your DPO systematically reduces your exposure at every stage.
Who Is This Article For?
This guide is relevant to:
- Data Protection Officers (in-house or outsourced) building or reviewing a compliance programme
- Legal, compliance, and privacy teams assessing GDPR enforcement exposure
- Senior leaders and DPOs who want to understand how fines are calculated and what mitigates them
- Organizations that have received — or are concerned about receiving — a supervisory authority inquiry
Understanding GDPR Supervisory Authority Enforcement Powers
GDPR grants supervisory authorities — such as the ICO in the UK, the CNIL in France, and the BfDI in Germany — significant enforcement powers, including the ability to impose administrative fines of up to €20 million or 4% of annual global turnover, whichever is higher. These are not theoretical maximums: multi-million-euro fines have been issued across sectors including technology, healthcare, retail, and financial services.
Your DPO helps minimize the risk of enforcement action in the first place, and coordinates your organization's response if one occurs.
Types of GDPR Administrative Enforcement Actions
GDPR Supervisory Authority Enforcement Actions and Their Legal Basis
Action
GDPR Article
Description
Warnings
Article 58(2)(a)
A formal warning that intended processing operations are likely to infringe the GDPR.
Reprimands
Article 58(2)(b)
An official reprimand issued where a confirmed infringement has occurred.
Orders
Article 58(2)(c–g)
Binding orders to comply, rectify, restrict, or erase personal data, or to suspend data flows.
Administrative Fines
Articles 83–84
Financial penalties calculated based on the severity, nature, and scope of the infringement.
How GDPR Administrative Fines Are Calculated Under Article 83
Under GDPR Article 83(2), supervisory authorities weigh the following factors when determining the size of an administrative fine:
- Nature, gravity, and duration of the infringement.
- Whether the infringement was intentional or the result of negligence.
- Actions taken by the controller or processor to mitigate harm to data subjects.
- Degree of responsibility, taking into account technical and organizational measures in place.
- Any previous GDPR infringements by the same controller or processor.
- Degree of cooperation with the supervisory authority during the investigation.
- Categories of personal data affected by the infringement.
- How the infringement came to the attention of the supervisory authority.
- Adherence to approved codes of conduct or recognized certification mechanisms.
Several of these factors — documented technical and organizational measures, proactive cooperation, and adherence to recognized compliance frameworks — are directly shaped by the quality of your DPO programme.
How Your DPO Reduces GDPR Enforcement Risk
A qualified Data Protection Officer — whether in-house or through an outsourced DPO service — addresses enforcement risk through six core activities:
Step 1 — Proactive Compliance Monitoring
Continuously identifying and addressing potential issues before they escalate into violations or trigger regulatory scrutiny. Proactive monitoring is one of the strongest signals of good faith an organization can demonstrate to a supervisory authority.
Step 2 — Accountability Documentation
Maintaining comprehensive records of processing activities, Data Protection Impact Assessments (DPIAs), risk assessments, and compliance decisions to demonstrate good governance. Under GDPR's accountability principle, documentation is not optional — it is the evidence that distinguishes a compliant organization from one that merely claims to be.
Step 3 — Timely Breach Notification
Ensuring personal data breaches are reported to supervisory authorities within GDPR's 72-hour notification window, demonstrating good faith and transparency. Late or absent breach notification is one of the most common triggers for enforcement action and is treated as an aggravating factor in fine calculations.
Step 4 — Technical and Organizational Measures
Implementing and documenting appropriate security and privacy controls — including data minimization, access controls, encryption, and pseudonymization — to reduce both operational risk and regulatory liability under Article 83(2)(d).
Step 5 — Staff Training
Delivering regular data protection training across the organization to minimize the risk of human error — one of the most common root causes of GDPR breaches and the easiest compliance gap for a supervisory authority to identify.
Step 6 — Supervisory Authority Relations
Building a constructive, cooperative relationship with your lead supervisory authority to support positive regulatory engagement. Regulators consistently treat cooperative organizations more favourably when determining sanctions.
Responding to a GDPR Enforcement Action: Your DPO's Role
If a supervisory authority initiates enforcement proceedings, your DPO coordinates the full organizational response:
- Manages all formal communication with the supervisory authority on behalf of the organization.
- Coordinates internal evidence gathering and prepares a structured, accurate response.
- Advises on remediation measures to demonstrate cooperation and reduce the risk of maximum penalties.
- Works alongside legal counsel in preparing any formal appeal, submission, or regulatory response.
- Documents lessons learned and implements preventive measures to reduce the likelihood of future infringements.
Frequently Asked Questions About GDPR Enforcement & Fines
How large can a GDPR fine be?
GDPR administrative fines can reach up to €20 million or 4% of annual global turnover, whichever is higher, for the most serious infringements under Article 83(5). Less severe violations under Article 83(4) carry a lower tier of up to €10 million or 2% of global turnover. The actual fine issued depends on the factors set out in Article 83(2), including the nature of the infringement, cooperation with the supervisory authority, and whether appropriate technical and organizational measures were in place.
What triggers a GDPR enforcement investigation?
GDPR investigations are typically triggered by a complaint from a data subject, a notified personal data breach, media reporting, or a supervisory authority's own-initiative audit. Failure to respond to a data subject access request within the statutory timeframe and late or absent breach notification are among the most common initial triggers.
Does having a DPO reduce GDPR fines?
Having a qualified Data Protection Officer does not provide automatic immunity from fines, but it materially reduces enforcement risk in two ways. First, a DPO prevents many violations from occurring through proactive compliance monitoring, documentation, and training. Second, where an infringement does occur, the accountability records and cooperation measures a DPO maintains are mitigating factors that supervisory authorities weigh under Article 83(2) when setting fine levels.
What is the GDPR breach notification deadline?
Under GDPR Article 33, controllers must notify their lead supervisory authority of a personal data breach within 72 hours of becoming aware of it, where the breach is likely to result in a risk to the rights and freedoms of individuals. Missing this deadline is treated as an aggravating factor when supervisory authorities calculate fines.
Can I use an outsourced DPO instead of hiring in-house?
Yes. GDPR Article 37(6) explicitly permits organizations to designate a DPO from outside the organization. An outsourced DPO service provides access to specialist data protection expertise without the cost of a full-time hire, and is a recognized and widely used model across EU and UK organizations of all sizes.
Related Articles
- When Is a Data Protection Officer Required Under GDPR?
- GDPR Personal Data Breach Notification: A Step-by-Step Guide
- Maintaining Records of Processing Activities (Article 30)
- Conducting a Data Protection Impact Assessment (DPIA)
---
# How Your DPO Supports GDPR Data Protection Certification — ISO 27001, ISO 27701 & Beyond
URL: https://support.secureprivacy.ai/article/dpo-guidance-data-protection-certifications-seals
Product: DPO as a Service
Category: DPO Operations
Published: 2026-03-09T15:01:00+00:00
Updated: 2026-03-26T01:31:24.67+00:00
Reading Time: 6 minutes
Summary: Learn which data protection certifications prove GDPR compliance — ISO 27001, ISO 27701, SOC 2 & more — and how your DPO guides you from gap analysis to audit.
When a client asks for proof of your data protection compliance — or a regulator requests evidence of lawful processing — a verbal assurance is rarely enough. Organizations that rely on internal checklists alone often find themselves scrambling ahead of vendor audits, struggling to produce the documentation that supervisory authorities and enterprise procurement teams now routinely demand.
Recognized data protection certifications change that dynamic. Under GDPR Articles 42–43, certification mechanisms, seals, and marks are actively encouraged as credible, independently verified evidence of compliant and secure data processing. Yet choosing between ISO 27001, ISO 27701, SOC 2, and GDPR-specific seals — and then actually preparing for the audit — can feel overwhelming without expert guidance.
That is where your Data Protection Officer (DPO) adds immediate, measurable value. Your DPO identifies the certifications that best match your industry, operations, and client requirements, then supports every stage of the journey: gap analysis, policy development, evidence preparation, and ongoing renewal. By the end of this article you will understand which data protection certifications matter most for GDPR compliance, what each one covers, and exactly how your DPO steers you from your current position to a successful certification outcome.
Who Is This Article For?
This guide is relevant to:
- Privacy and compliance managers building the business case for certification
- DPOs and legal teams advising on certification strategy and audit readiness
- IT and security leaders responsible for implementing the controls certifications require
- Business owners and executives whose clients or supply chain contractually require proof of GDPR compliance
The Role of Data Protection Certifications in GDPR Compliance
GDPR Articles 42–43 explicitly encourage the establishment of data protection certification mechanisms, seals, and marks to demonstrate compliance with the Regulation. A valid certification does not provide an absolute exemption from GDPR obligations, but it does constitute meaningful evidence of lawful processing and can serve as a mitigating factor in regulatory enforcement actions.
Your DPO advises on which certifications are most relevant to your organization and supports the full preparation process — from initial gap analysis through to audit readiness and long-term renewal.
Common Data Protection and GDPR Compliance Certifications
Overview of key data protection certifications and their relevance to GDPR compliance
Certification
Focus Area
Relevance to GDPR Compliance
ISO 27001
Information security management
Demonstrates robust security controls supporting GDPR compliance
ISO 27701
Privacy information management
Extension to ISO 27001 specifically addressing GDPR requirements for data controllers and processors
SOC 2 Type II
Service organization controls
Demonstrates security, availability, and confidentiality controls relevant to GDPR accountability
GDPR-Specific Seals
GDPR compliance
Approved certification bodies verify the GDPR compliance of specific processing operations
Cyber Essentials
Basic cybersecurity hygiene
UK government-backed scheme demonstrating baseline security controls aligned with GDPR security obligations
How Your DPO Supports GDPR Certification Readiness
Your Data Protection Officer guides your organization through each phase of the certification process — from identifying gaps to maintaining compliance after the audit.
Step 1 — Gap Assessment
Your DPO evaluates your current data protection and security practices against the specific requirements of your target certification, identifying the areas that need improvement before audit.
Step 2 — Roadmap Development
Based on the gap assessment, your DPO creates a structured, prioritized remediation plan — setting realistic milestones and resource requirements so you can progress toward certification without disrupting business operations.
Step 3 — Policy Development
Your DPO drafts or updates internal data protection policies, privacy notices, and operational procedures to meet the specific documentation requirements of the chosen certification framework.
Step 4 — Evidence Preparation
Certification auditors require organized, verifiable evidence of compliant practices. Your DPO collates documentation, processing records, risk assessments, and control evidence to satisfy auditor requirements.
Step 5 — Audit Support
Throughout the certification audit itself, your DPO provides expert guidance — responding to auditor queries, clarifying technical and legal points, and ensuring the process runs smoothly.
Step 6 — Ongoing Maintenance and Renewal
Certification is not a one-time event. Your DPO supports continuous compliance activities — periodic reviews, control updates, and renewal cycles — so that your certification remains valid and meaningful.
Benefits of Achieving Data Protection Certification
- Provides credible, independently verified evidence of GDPR compliance to supervisory authorities, and can serve as a mitigating factor in enforcement actions.
- Builds trust with customers, partners, and stakeholders by signalling a sustained commitment to data protection and privacy.
- Creates a structured framework for continuous security and privacy improvement — rather than point-in-time compliance.
- Satisfies vendor due diligence and data protection requirements increasingly imposed by enterprise clients and supply chains.
- Can reduce the frequency and scope of individual audits requested by business partners, lowering the compliance burden over time.
Choosing the Right GDPR Certification for Your Organization
No single data protection certification is right for every organization. Your DPO weighs the following factors when recommending the most appropriate certification path:
- Your industry sector and the data protection expectations of your customers and regulators.
- Your existing security and privacy maturity — and how much remediation work a given certification realistically requires.
- The resources available for certification preparation and long-term annual maintenance.
- Whether specific certifications (for example, ISO 27001 or SOC 2 Type II) are contractually required by your clients or supply chain partners.
- The geographic scope of your operations and any applicable data protection laws beyond the GDPR (for example, UK GDPR or sector-specific regulations).
Frequently Asked Questions
Does GDPR require organizations to hold a specific certification?
No. GDPR does not mandate any specific certification. However, Articles 42–43 actively encourage certification as a way to demonstrate compliance. Holding a recognized data protection certification — such as ISO 27701 or a GDPR-approved seal — provides credible evidence of lawful processing and can be a meaningful mitigating factor if a supervisory authority investigates your organization.
What is the difference between ISO 27001 and ISO 27701 for GDPR compliance?
ISO 27001 is an internationally recognized standard for information security management systems (ISMS). ISO 27701 is an extension of ISO 27001 that adds privacy-specific controls, explicitly addressing the requirements of GDPR for both data controllers and processors. Organizations that already hold ISO 27001 certification can add ISO 27701 as a natural next step to strengthen their GDPR compliance posture.
How long does it take to achieve GDPR data protection certification?
Timelines vary depending on the certification type and your organization's starting maturity. ISO 27001 certification typically takes 6–18 months from gap assessment to first audit. Your DPO's gap assessment will give you a realistic, organization-specific estimate based on the remediation work required.
Can data protection certification replace individual client security audits?
Not always, but it significantly reduces the burden. Many enterprise clients and procurement teams accept recognized certifications — particularly ISO 27001 and SOC 2 Type II — as a substitute for, or a significant reduction in the scope of, their own vendor security assessments. Your DPO can help position your certification to satisfy specific client due diligence requirements.
What role does the DPO play in maintaining certification after the initial audit?
Certification is renewed periodically — typically annually for surveillance audits and every three years for full recertification under ISO standards. Your DPO supports ongoing compliance activities between audits: monitoring control effectiveness, updating policies when data protection laws or internal processes change, and ensuring your organization is always renewal-ready.
Related Articles
- What Does a Data Protection Officer Do? Roles and Responsibilities Explained
- How to Conduct a GDPR Gap Analysis Before Your Certification Audit[?]
- ISO 27701 and GDPR: How Privacy Information Management Certification Supports Compliance[?]
- Maintaining Records of Processing Activities Under GDPR Article 30
---
# DPO as a Service Plans Explained: Choose the Right GDPR Compliance Support for Your Organization
URL: https://support.secureprivacy.ai/article/dpo-as-a-service-pricing-and-plans-explained
Product: DPO as a Service
Category: DPO Fundamentals
Published: 2026-03-09T15:01:00+00:00
Updated: 2026-03-26T01:26:37.998+00:00
Reading Time: 6 minutes
Summary: Compare Secure Privacy's Essential, Professional, and Enterprise DPO as a Service plans. Find the right outsourced Data Protection Officer for your GDPR compliance needs.
Do You Really Need a Data Protection Officer — and How Much Support Is Enough?
Under the GDPR, many organizations are legally required to appoint a qualified Data Protection Officer — and even those that aren't still face mounting pressure to demonstrate accountability, respond to data subject access requests, manage vendor risk, and document their processing activities. Getting that wrong can mean regulatory fines, enforcement action, and reputational damage that far outweighs the cost of proper compliance.
The instinct for most organizations is to hire an in-house DPO. But a full-time, qualified data protection officer is expensive, hard to recruit, and — for smaller organizations — simply out of proportion to the actual workload. The alternative of assigning the role to an existing employee typically results in an under-resourced, under-qualified function that satisfies the letter of the law while leaving real gaps. Neither option is ideal.
That's where outsourced DPO services change the equation. A DPO as a Service gives your organization a named, registered, qualified Data Protection Officer — along with structured GDPR compliance support — at a fraction of the cost of a full-time hire, and with none of the recruitment risk.
Secure Privacy offers three DPO as a Service plans — Essential, Professional, and Enterprise — each calibrated to a different level of organizational complexity, data processing volume, and compliance risk. By the end of this guide, you'll know exactly which plan fits your situation and what you'll receive under each tier.
Who Is This Guide For?
- Organizations that are legally required to appoint a DPO under GDPR Article 37 but want an external, outsourced solution
- Small and mid-sized businesses seeking affordable GDPR compliance support without the overhead of an in-house hire
- Enterprises managing complex, multi-jurisdictional data flows that need dedicated, round-the-clock DPO coverage
- Existing Secure Privacy customers evaluating whether to upgrade their current DPO as a Service plan
Choosing the Right DPO as a Service Plan
Each Secure Privacy DPO as a Service plan provides a named, qualified Data Protection Officer along with a core set of GDPR compliance services. The plans differ in the depth, frequency, and scope of support — allowing you to match the level of outsourced DPO coverage to your organization's specific risk profile, vendor complexity, and operational scale.
DPO as a Service Plan Comparison
Feature-by-feature comparison of Secure Privacy DPO as a Service plans: Essential, Professional, and Enterprise
Feature
Essential
Professional
Enterprise
Named DPO
Yes
Yes
Dedicated DPO + backup
DPO Registration
Yes
Yes
Yes
Compliance Gap Analysis
Annual
Semi-annual
Quarterly
DPIA Support
Up to 2/year
Up to 6/year
Unlimited
Staff Training
Annual session
Quarterly sessions
Custom program
Compliance Reporting
Quarterly summary
Monthly operational + quarterly executive
Full reporting suite
Breach Response
Business hours
Extended hours
24/7 emergency line
DSAR Advisory
Guidance
Guidance + review
Full management
Vendor Reviews
Up to 5/year
Up to 15/year
Unlimited
Platform Access
Basic
Full
Full + API
Which DPO as a Service Plan Is Right for Your Organization?
- Essential: Best suited to small organizations with straightforward data processing activities, a limited number of vendors, and minimal cross-border data transfers.
- Professional: Ideal for mid-sized organizations managing moderate data processing complexity, multiple third-party vendors, and some international data transfers requiring ongoing GDPR oversight.
- Enterprise: Designed for large or complex organizations with extensive data processing operations, numerous vendors, and multi-jurisdictional compliance requirements needing dedicated, round-the-clock outsourced DPO support.
What Every Secure Privacy DPO as a Service Plan Includes
Regardless of the plan you choose, all Secure Privacy DPO as a Service subscriptions include the following core GDPR compliance services:
1 — Formal DPO Appointment and Regulatory Registration
A qualified Data Protection Officer is formally appointed on your organization's behalf and registered with the relevant supervisory authority, satisfying GDPR Article 37 obligations.
2 — Ongoing GDPR Compliance Advisory and Proactive Monitoring
Your DPO provides continuous advisory support and proactively monitors your data processing activities for emerging compliance risks.
3 — Access to the Secure Privacy Data Governance Platform
All plans include access to the Secure Privacy compliance platform, centralizing your data governance documentation, consent records, and processing registers.
4 — Regulatory Updates and Impact Analysis
As data protection laws evolve — including GDPR amendments, ePrivacy developments, and jurisdiction-specific rulings — your DPO provides timely impact analysis for your organization.
5 — Annual GDPR Compliance Audit
A structured annual audit assesses and documents your organization's GDPR compliance posture, identifying gaps and recommending remediation steps.
6 — Data Subject Access Request (DSAR) Process Guidance
Your DPO advises on handling DSARs correctly and within statutory timescales, reducing the risk of regulatory complaints from data subjects.
7 — Personal Data Breach Notification Support
In the event of a personal data breach, your DPO supports your response process, including assessing notifiability and preparing documentation for supervisory authorities.
Getting Started with Secure Privacy DPO as a Service
Contact your Secure Privacy account manager or visit the DPO as a Service section in your dashboard to explore available plans and request a consultation. Custom plans are also available for organizations with specific regulatory requirements or operational structures. Our team will assess your current GDPR compliance position and recommend the outsourced DPO plan best aligned to your needs, risk exposure, and budget.
Frequently Asked Questions About DPO as a Service
Is a Data Protection Officer legally required under GDPR?
Under GDPR Article 37, a DPO is mandatory for public authorities, organizations that carry out large-scale systematic monitoring of individuals, and those that process special category data at scale. Many other organizations appoint a DPO voluntarily as a best-practice accountability measure. A DPO as a Service solution satisfies the formal appointment and registration requirement in all cases.
What is the difference between an in-house DPO and a DPO as a Service?
An in-house DPO is a full-time employee, which carries significant recruitment, salary, and retention costs. A DPO as a Service provides a named, qualified, externally registered Data Protection Officer on a subscription basis — delivering the same regulatory compliance coverage at a fraction of the cost, with no hiring risk. The GDPR explicitly permits organizations to fulfil the DPO requirement through a service contract.
Which Secure Privacy DPO as a Service plan is best for a small business?
The Essential plan is designed for small organizations with straightforward data processing activities, a limited vendor base, and minimal cross-border data transfers. It includes a named DPO, annual compliance gap analysis, up to two DPIAs per year, annual staff training, quarterly compliance reporting, and personal data breach support during business hours.
What does DPIA support mean in a DPO as a Service plan?
A Data Protection Impact Assessment (DPIA) is a structured process for identifying and mitigating privacy risks in high-risk processing activities. Your outsourced DPO assists in scoping, conducting, and documenting DPIAs. The number of DPIAs supported per year varies by plan: up to 2 under Essential, up to 6 under Professional, and unlimited under Enterprise.
Can I upgrade my DPO as a Service plan as my organization grows?
Yes. Secure Privacy DPO as a Service plans are designed to scale with your organization. You can upgrade from Essential to Professional or Enterprise at any point by contacting your Secure Privacy account manager. Custom plans are also available for organizations with unique regulatory or operational requirements.
Does Secure Privacy handle data breach notifications as part of the DPO service?
Yes. All Secure Privacy DPO as a Service plans include personal data breach notification support. Response availability scales by plan: business hours under Essential, extended hours under Professional, and a 24/7 emergency line under Enterprise — ensuring you meet the GDPR's 72-hour supervisory authority notification window regardless of when a breach occurs.
Related Articles
- What Is a Data Protection Officer and Do You Need One?
- How to Conduct a Data Protection Impact Assessment (DPIA)
- Managing Data Subject Access Requests Under GDPR
- GDPR Data Breach Notification: Requirements and Timelines
- Secure Privacy Data Governance Platform Overview
---
# DPO as a Service - FAQ: Qualifications, GDPR Compliance & Onboarding | Secure Privacy
URL: https://support.secureprivacy.ai/article/frequently-asked-questions-dpo-as-a-service
Product: DPO as a Service
Category: DPO Fundamentals
Published: 2026-03-09T15:01:00+00:00
Updated: 2026-03-26T01:23:55.519+00:00
Reading Time: 4 minutes
Summary: Get answers on outsourced DPO qualifications, GDPR Article 37 compliance, onboarding timelines, and multi-entity coverage. Secure Privacy DPO as a Service.
GDPR mandates a Data Protection Officer for many organizations — yet recruiting, retaining, and compensating a qualified in-house DPO is costly, slow, and increasingly competitive. Hiring junior staff and hoping they grow into the role creates compliance gaps that regulators notice. Relying on your existing legal or IT team spreads expertise too thin and leaves you exposed when a data breach or supervisory authority inquiry lands in your inbox.
Outsourced DPO services — sometimes called virtual DPO, fractional DPO, or DPO as a Service — solve this directly. Under GDPR Article 37(6), an external Data Protection Officer is fully lawful and carries exactly the same authority as an in-house appointment. Secure Privacy's DPO as a Service gives you a certified, experienced DPO from day one, without the recruitment overhead, at a predictable monthly cost.
This FAQ answers the questions organizations most commonly ask before appointing an external DPO — covering qualifications, regulatory compliance, onboarding timelines, multi-entity coverage, service continuity, and plan flexibility. By the end you'll know exactly what to expect from a managed DPO service and whether it's the right fit for your organization.
Who Is This Article For?
This FAQ is written for:
- Legal, compliance, and privacy teams evaluating whether an outsourced DPO satisfies GDPR requirements.
- CEOs and COOs at SMEs, scale-ups, and mid-market companies deciding between hiring in-house versus engaging a DPO service.
- Corporate groups and holding companies looking to appoint a single DPO across multiple legal entities.
- Existing Secure Privacy customers onboarding or managing their DPO as a Service subscription.
General Questions About DPO as a Service
What qualifications do Secure Privacy's DPOs hold?
All Secure Privacy DPOs hold recognized data protection certifications — such as CIPP/E, CIPM, or equivalent — and bring extensive practical experience in GDPR compliance across multiple industries and regulatory environments. Our DPOs maintain and deepen their expertise through continuous professional development, ensuring up-to-date knowledge of evolving data protection requirements.
Can an external DPO fulfill the GDPR legal requirement?
Yes. GDPR Article 37(6) explicitly states that the Data Protection Officer may be a staff member or fulfill their tasks on the basis of a service contract. External and outsourced DPOs are fully recognized and lawful under the regulation — making DPO as a Service a compliant and cost-effective alternative to hiring an in-house DPO.
How quickly can DPO as a Service be set up?
Standard onboarding typically takes 2–4 weeks, covering the initial consultation, compliance gap analysis, and formal DPO registration with your relevant supervisory authority. For organizations with urgent compliance deadlines, expedited onboarding is also available — contact your account manager to discuss timelines.
Scope and Coverage of the External DPO Service
Which data protection regulations does the outsourced DPO cover?
While GDPR is the primary regulatory focus, your assigned DPO also advises on a broader range of applicable data protection and privacy laws, including:
- EU member state data protection laws and national implementations.
- ePrivacy Directive requirements (cookies, electronic communications).
- UK GDPR and the Data Protection Act 2018 (post-Brexit).
- Other international data protection regulations relevant to your operations.
Can one external DPO cover multiple legal entities within our corporate group?
Yes. GDPR Article 37(2) allows a group of undertakings to appoint a single Data Protection Officer, provided the DPO is easily accessible from each establishment. Secure Privacy fully supports multi-entity and group-wide DPO arrangements, with structured coverage across all relevant legal entities.
What happens to our compliance program if our assigned DPO leaves Secure Privacy?
Service continuity is guaranteed. If your assigned DPO changes for any reason, a qualified replacement is appointed promptly, with a structured handover process to ensure no disruption to your GDPR compliance program, ongoing projects, or supervisory authority relationships.
Practical Questions About Working with an Outsourced DPO
Do we still need an internal privacy contact if we use an external DPO?
While not legally required under GDPR, we strongly recommend designating an internal privacy champion within your organization. This person coordinates day-to-day privacy activities, serves as the primary internal liaison with your external DPO, and helps ensure that data protection considerations are embedded across teams and processes.
How is client confidentiality maintained under a DPO as a Service arrangement?
Your DPO is bound by strict confidentiality obligations as required by GDPR Article 38(5), which prohibits the DPO from disclosing information obtained in the performance of their tasks. All Secure Privacy staff who handle client data are additionally subject to confidentiality agreements and appropriate security clearances, ensuring the highest standards of data privacy and professional discretion.
Can we upgrade or downgrade our DPO as a Service plan?
Yes. Plans can be adjusted at any renewal period to match your evolving compliance needs and organizational growth. If your requirements change significantly mid-term — for example, due to a merger, acquisition, or rapid expansion — contact your Secure Privacy account manager to discuss interim options.
Summary: Key DPO as a Service Questions at a Glance
Quick Reference — Common DPO as a Service Questions Answered
Question
Answer
Is an external DPO GDPR-compliant?
Yes — explicitly permitted under GDPR Article 37(6).
How long does onboarding take?
2–4 weeks standard; expedited onboarding available for urgent needs.
Can one DPO cover multiple group entities?
Yes — supported under GDPR Article 37(2).
Is service continuity guaranteed?
Yes — guaranteed with a structured DPO handover process.
Can we change our plan?
Yes — upgrade or downgrade at renewal, or mid-term by arrangement.
Related Articles
- What Does a Data Protection Officer Actually Do?
- Does My Organization Need a DPO Under GDPR?
- DPO as a Service Plans and Pricing
- GDPR Compliance Checklist for Businesses
---
# GDPR Accountability Principle: Compliance Documentation and DPO Responsibilities
URL: https://support.secureprivacy.ai/article/dpo-support-gdpr-accountability-documentation
Product: DPO as a Service
Category: DPO Compliance
Published: 2026-03-09T15:00:00+00:00
Updated: 2026-03-26T01:21:24.448+00:00
Reading Time: 6 minutes
Summary: Learn what GDPR Article 5(2) accountability requires, which documents your DPO must maintain, and how Secure Privacy keeps you audit-ready at all times.
A supervisory authority investigation doesn't announce itself in advance — and when it arrives, the first thing regulators ask for is evidence. Not a promise of compliance, not a policy document drafted three years ago and never revisited, but a complete, current, version-controlled record of every significant data processing decision your organization has made. For most organizations, that moment reveals the same uncomfortable reality: compliance knowledge lives in people's heads, documentation is scattered across shared drives, and there is no clear owner.
Many organizations attempt to solve this with generic spreadsheet templates or off-the-shelf policy bundles — only to find that those documents quickly fall out of sync with actual processing activities, leaving gaps that are hard to explain to a regulator and harder still to fix under time pressure.
The GDPR accountability principle requires a fundamentally different approach: structured, maintained, and demonstrable compliance — not just compliance on paper. That is precisely what a qualified Data Protection Officer (DPO), supported by a purpose-built platform like Secure Privacy, delivers. Together, they give your organization a living accountability framework — one where every required document exists, is kept current, and can be produced at a moment's notice.
By the end of this article you will understand exactly which GDPR accountability documents are legally required, what your DPO is responsible for maintaining, and how Secure Privacy's compliance platform makes the entire process manageable and audit-ready.
Who Is This Article For?
This guide is relevant to:
- Data Protection Officers (DPOs) building or maintaining a GDPR accountability framework
- Legal, compliance, and privacy teams preparing for supervisory authority reviews or internal audits
- CTOs, COOs, and senior management seeking to understand their organization's documentation obligations under GDPR Article 5(2)
- Organizations evaluating GDPR compliance software or a DPO-as-a-service solution
The GDPR Accountability Principle Explained (Article 5(2))
GDPR Article 5(2) establishes the accountability principle: organizations must not only comply with core data protection principles but must also be able to demonstrate that compliance through documented evidence. Your DPO ensures your organization maintains the documentation, records, and internal processes needed to meet this legal obligation — and to respond effectively if a supervisory authority requests proof of compliance.
In practice, this means accountability is not a one-time project. It is an ongoing discipline that requires consistent record-keeping, regular reviews, and a clear governance structure with defined ownership of each compliance document.
Required GDPR Accountability Documents and Your DPO's Responsibilities
The table below maps each key accountability document to its legal basis under the GDPR and the specific responsibility your DPO carries for that record.
Required GDPR Accountability Documents, Legal Basis, and DPO Responsibilities
Document
GDPR Requirement
DPO Responsibility
Records of Processing Activities (ROPA)
Article 30
Create, maintain, and regularly update.
Data Protection Impact Assessments (DPIAs)
Article 35
Advise on necessity, conduct, and review outcomes.
Privacy Policies and Notices
Articles 13–14
Draft, review, and update to reflect current processing activities.
Data Processing Agreements (DPAs)
Article 28
Review vendor agreements and advise on compliance requirements.
Breach Register
Article 33(5)
Maintain a complete log and document all personal data incidents.
Consent Records
Article 7(1)
Oversee consent collection, management, and withdrawal processes.
Legitimate Interest Assessments (LIAs)
Article 6(1)(f)
Conduct, document, and review to justify lawful processing basis.
Training Records
Article 39(1)(b)
Track staff training completion and report on awareness levels.
DSAR Response Log
Articles 15–22
Oversee data subject request handling and review response quality.
Best Practices for GDPR Accountability Documentation
Maintaining GDPR accountability documentation is an ongoing obligation, not a one-off exercise. The following practices help organizations keep their compliance records complete, current, and ready for regulatory scrutiny.
Centralize All Documentation
Store all accountability records in a single, accessible location to ensure they can be retrieved quickly during supervisory authority reviews or internal audits. A centralized GDPR compliance management system eliminates the risk of version conflicts and missing records.
Apply Version Control
Track changes to all documents over time so you can demonstrate the evolution of your compliance posture and identify when updates were made. Version history is especially important when responding to supervisory authority inquiries about past processing decisions.
Set Review Schedules
Assign a defined review frequency to each document type — ensuring records remain accurate, current, and aligned with actual processing activities. Annual reviews are a minimum; high-risk processing activities may warrant more frequent checks.
Write Clearly and Accurately
Accountability documentation must be understandable to both internal stakeholders and external regulators — avoid jargon and ensure factual accuracy throughout. Clear language also reduces the risk of misinterpretation during an audit.
Record Decision-Making Processes
Document not just compliance outcomes but the rationale and evidence behind key decisions — this is critical for demonstrating accountability under GDPR Article 5(2). Regulators want to see why you made a decision, not just what you decided.
Secure Access Controls
Store all accountability documentation with appropriate security measures and role-based access controls to protect sensitive information while keeping it accessible to authorized personnel. Restricting edit access prevents accidental overwrites of audit-critical records.
How Secure Privacy Supports GDPR Accountability
The Secure Privacy platform provides a centralized hub for all GDPR accountability documentation. Your DPO uses the platform to maintain, update, and provide structured access to all required records — ensuring they are organized, version-controlled, and readily available for supervisory authority review at any time.
By combining expert DPO oversight with purpose-built compliance technology, Secure Privacy helps your organization move from reactive compliance to a proactive, demonstrable accountability framework — one that satisfies regulators and protects the rights of your data subjects.
Frequently Asked Questions: GDPR Accountability
What is the GDPR accountability principle and what does it require?
The GDPR accountability principle, set out in Article 5(2), requires organizations to not only comply with data protection law but to actively demonstrate that compliance through documented evidence. This means maintaining accurate records of processing activities, impact assessments, consent logs, breach registers, and other accountability documentation — and making these available to supervisory authorities on request.
What documents do I need to prove GDPR compliance?
Key GDPR accountability documents include: Records of Processing Activities (ROPA) under Article 30, Data Protection Impact Assessments (DPIAs) under Article 35, privacy notices under Articles 13–14, data processing agreements under Article 28, a breach register under Article 33(5), consent records under Article 7, legitimate interest assessments, staff training records, and a log of data subject access request (DSAR) responses.
What happens if my organization cannot demonstrate GDPR compliance during an audit?
Failure to demonstrate compliance under GDPR Article 5(2) can result in significant fines — up to €20 million or 4% of global annual turnover, whichever is higher — as well as corrective orders from supervisory authorities. Beyond financial penalties, inadequate accountability documentation can undermine your defense in any data breach or data subject complaint investigation.
Does every organization need a Data Protection Officer (DPO) for GDPR accountability?
Under GDPR Articles 37–39, a DPO is mandatory for public authorities, organizations that carry out large-scale systematic monitoring of individuals, or those that process special category data at scale. Even where a DPO is not legally required, having a dedicated privacy function — or using a DPO-as-a-service solution — is strongly recommended to manage ongoing GDPR accountability obligations effectively.
How does Secure Privacy help with GDPR accountability documentation?
Secure Privacy provides a centralized compliance platform where your DPO can maintain, version-control, and manage all required GDPR accountability documents — from ROPA and DPIAs to consent records and breach registers. The platform is designed to make accountability documentation audit-ready at all times, reducing the burden on internal teams and ensuring nothing falls through the gaps.
Related Articles
- How to Build and Maintain Your Records of Processing Activities (ROPA)
- When Is a Data Protection Impact Assessment (DPIA) Required?[?]
- DPO Role and Responsibilities Under GDPR
- Managing Data Subject Access Requests (DSARs) Efficiently
- GDPR Breach Notification: Timelines, Requirements, and Templates[?]
---
# Privacy Risk Management Module – GDPR Risk Assessment, Mitigation Planning, and DPIA Support in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/governance-solution-core-module--risks
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T10:08:19.474+00:00
Reading Time: 4 minutes
Summary: Use the Privacy Risk Management module in Secure Privacy's Governance Solution to assess, categorize, and mitigate privacy risks — with integrated DPIA support and audit-ready risk records.
The Privacy Risk Management module in Secure Privacy's Governance Solution provides a systematic approach to identifying, evaluating, and mitigating privacy risks across your organization's data processing activities. It enables privacy professionals to conduct structured risk assessments, develop mitigation strategies, assign ownership, and maintain continuous oversight — supporting GDPR compliance, Data Protection Impact Assessments (DPIAs), and broader privacy program governance.
Who Is This For?
- Data Protection Officers and privacy managers responsible for GDPR risk assessment and DPIA workflows
- Compliance and legal teams identifying and tracking privacy risks across processing activities
- IT and security teams managing technical risks associated with personal data processing systems
- Risk owners and team members assigned to monitor and remediate identified privacy risks
Purpose and Functionality
The Privacy Risk Management module is a core component of Secure Privacy's Governance Solution, giving compliance teams a single, structured environment to document privacy risks, score their likelihood and impact, plan mitigations, and track remediation progress. By integrating risk management directly into the governance platform, it creates a clear, auditable chain from identified risk to mitigation — supporting DPIA requirements under GDPR Article 35 and the accountability principle under Article 5(2).
How to Use the Privacy Risk Management Module
- Navigate to the Privacy Risk Management section from the main navigation menu in the Governance Solution.
- Create a new risk entry and document the risk name, description, and the data processing activity it relates to.
- Categorize the risk by type — Security, Compliance, or Operational — and score it using the likelihood and impact matrix.
- Define mitigation measures to address the identified risk, including the controls to be implemented and their target completion date.
- Assign the risk to a team member for ongoing management and accountability.
- Monitor mitigation progress through the risk register and update status as actions are completed.
- Review and reassess risks periodically or whenever the associated processing activity changes.
Available Features
- Risk assessment and documentation: Create structured risk records with descriptions, categories, likelihood and impact scores, and links to relevant processing activities.
- Risk categorization and prioritization: Classify risks by type and severity to focus remediation efforts on the highest-priority items first.
- Mitigation planning: Document specific mitigation measures, assign deadlines, and track implementation status for each identified risk.
- Assignment of responsibilities: Assign risk ownership to specific team members, ensuring clear accountability for monitoring and remediation.
Common Use Cases
- Identifying and assessing privacy risks associated with data processing activities — supporting DPIA pre-screening and structured risk documentation under GDPR Article 35.
- Developing and tracking mitigation plans to reduce identified risks to an acceptable level before or during processing.
- Monitoring the ongoing status of risk mitigation efforts across the organization — with audit-ready records for supervisory authority review.
Troubleshooting
Cannot add a new risk
Verify that your account has the necessary permissions to create entries in the Privacy Risk Management module. Only users with the appropriate role can add new risks. Contact your Secure Privacy account administrator to review your access rights.
Cannot assign a risk to a team member
The team member must have an active user account within your Secure Privacy organization with the appropriate role assigned. Check that the intended assignee exists in the Members module and has the correct permissions. Contact your account administrator if the user account needs to be created or updated.
Frequently Asked Questions
How does the Privacy Risk Management module support GDPR DPIA requirements?
The module supports DPIA workflows by providing a structured environment for identifying risks to data subjects' rights and freedoms, scoring their likelihood and severity, and documenting mitigation measures — the core elements required under GDPR Article 35(7). Risk records created in the module can feed directly into DPIA documentation, providing an auditable trail from risk identification to mitigation sign-off.
Can risks be linked to specific systems or processing activities?
Yes. Risk entries can be linked to processing activities and systems documented elsewhere in the Governance Solution, creating end-to-end traceability from data processing activity to identified risk to mitigation measure — supporting both ROPA accuracy and DPIA completeness.
Who should be assigned as a risk owner?
Risk ownership should be assigned to the team member with operational responsibility for the processing activity or system the risk relates to — typically the system owner, department head, or technical lead. The DPO or privacy manager retains oversight responsibility across the risk register as a whole.
See Also
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
- Website Visits vs Page Views vs Consent Explained
---
# How to Classify and Edit Cookies and Services in Secure Privacy – Cookie Classification Guide
URL: https://support.secureprivacy.ai/article/cmp-v1-how-to-classify-and-edit-your-cookies-and-services
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T22:01:02.317+00:00
Reading Time: 3 minutes
Summary: [CMP v1] Learn how to edit cookie categories, service names, privacy policy links, and descriptions in Secure Privacy's Classification feature — and when to rescan to apply your changes.
Secure Privacy's Cookie Classification feature lets you review, edit, and recategorize the cookies and services detected on your website — including their category, service name, privacy policy link, and description. Changes to cookie classification are applied to your cookie declaration after a domain rescan.
Note: Any changes made to cookie classification will only be reflected in your cookie declaration after you trigger a website rescan from the Report section.
Who Is This For?
- Website administrators reviewing and correcting cookie categories assigned by the Secure Privacy scanner
- Compliance teams ensuring cookies are accurately classified as Essential, Analytics, Marketing, or other categories
- Developers updating service names, privacy policy links, and cookie descriptions in the classification register
How to Access Cookie Classification
- Log in to your Secure Privacy account and select the domain you want to work with by clicking the domain name selector and choosing the correct domain.
- Click Classification in the left sidebar.
How to Edit the Category of a Cookie or Service
- Locate the cookie or service you want to edit and click its Edit button.
- Select the required Category from the dropdown list to match your compliance requirements and business logic.
Note on terminology: Host refers to the domain name of the website that places the specific cookie. Service is the widely recognized name or tag associated with that cookie — for example, "Google Analytics" or "Facebook Pixel."
- In addition to the Category, you can also edit the Service name or tag, the Privacy Policy link, and the Description for the cookie. Click Save to apply your changes.
Important — Multiple categories: If a service shows a Multiple categories value, it means the individual cookies from that service provider have been assigned to different categories. This can cause unexpected behavior in your Consent tracker: if a visitor blocks one category but allows another from the same service provider, all cookies from that provider will be blocked — because the block action takes precedence over the allow action. Review and align the categories for all cookies from the same service provider to avoid this.
Frequently Asked Questions
Do I need to rescan after editing cookie classifications?
Yes. Changes to cookie classification are not reflected in your live cookie declaration until you trigger a website rescan from the Report section. Run a rescan after completing your classification edits to apply the updates.
What is the difference between Host and Service in the classification view?
The Host is the domain name of the website that sets the cookie — for example, analytics.google.com. The Service is the human-readable name associated with the cookie — for example, "Google Analytics." Editing the Service name updates how it appears in your cookie declaration to visitors.
What should I do if a cookie is assigned to the wrong category?
Click Edit next to the cookie or service and select the correct category from the Category dropdown. Common categories include Essential, Analytics, Marketing, Functional, and Unclassified. Save the change and rescan your domain to update your cookie declaration.
See Also
- How to Block a Cookie in the Scan Report
- How to Add a Custom Service or Cookie
- Secure Privacy Pricing Plans Overview
---
# Calendar Module – Compliance Deadline Tracking and Task Management in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/governance-solution-core-module--calendar
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T11:25:39.601+00:00
Reading Time: 4 minutes
Summary: Track compliance deadlines, schedule privacy tasks, and monitor ongoing initiatives using the Calendar module in Secure Privacy's Governance Solution — built for GDPR program management.
The Calendar module in Secure Privacy's Governance Solution is a centralized compliance task and deadline management tool — giving your privacy team a clear, visual overview of all upcoming compliance deadlines, recurring tasks, and regulatory requirements. It transforms complex compliance scheduling into an intuitive calendar experience that keeps your organization ahead of critical dates.
Who Is This For?
- Data Protection Officers and privacy managers tracking compliance deadlines and recurring program tasks
- Compliance teams scheduling privacy training sessions, audit reviews, and policy update cycles
- Risk and governance teams monitoring the progress of ongoing compliance initiatives and mitigation deadlines
- Team members assigned to time-sensitive compliance actions within the Governance Solution
Purpose and Functionality
The Calendar module consolidates all compliance-related tasks and deadlines from across the Governance Solution into a single, visual calendar interface. Whether you are tracking DSAR response deadlines, scheduling staff training, or monitoring risk mitigation target dates, the Calendar module ensures nothing is missed — providing a shared, organized view of your compliance program's time-sensitive obligations.
How to Use the Calendar Module
- Navigate to the Calendar page from the main navigation menu in the Governance Solution.
- View all scheduled tasks and compliance deadlines in the monthly calendar format.
- Click on a specific date to see the full list of tasks scheduled for that day.
- Drag and drop tasks to reschedule them to a different date as priorities change.
- Add new compliance tasks directly from the calendar view without leaving the module.
Available Features
- Monthly calendar view: A visual overview of all compliance tasks and deadlines organized by date — giving your team an immediate picture of what is coming up.
- Task rescheduling via drag and drop: Easily move tasks to new dates by dragging and dropping them directly on the calendar — no need to open individual task records.
- Task creation from calendar view: Add new compliance tasks directly from the calendar interface, with the selected date pre-populated as the due date.
- Filtering by category or assignee: Filter the calendar view by task category or assigned team member to focus on the deadlines most relevant to your role or area of responsibility.
Common Use Cases
- Tracking upcoming compliance deadlines — including DSAR response windows, breach notification timelines, and regulatory submission dates — to ensure nothing is missed.
- Scheduling recurring privacy training sessions and annual compliance review cycles across the organization.
- Monitoring the progress of ongoing compliance initiatives, risk mitigation target dates, and action plan deadlines from the Privacy Risk Management module.
Troubleshooting
Tasks are not displaying
Check that the correct filters are applied — if a category or assignee filter is active, tasks outside that filter will not appear. Clear all filters to see the full calendar view. If tasks are still missing, verify that they have been assigned a due date in the relevant module.
Cannot reschedule a task
Rescheduling tasks via drag and drop requires edit permissions for the task in question. Verify your user role with your Secure Privacy account administrator. If the task was created in another module — such as the Privacy Risk Management or Process Register module — it may need to be updated from its source record.
Frequently Asked Questions
Are tasks from other Governance Solution modules automatically visible in the Calendar?
Yes. Tasks and deadlines created across the Governance Solution — including mitigation deadlines from the Privacy Risk Management module and action items from compliance reviews — are surfaced in the Calendar module, providing a unified view of all time-sensitive compliance obligations in one place.
Can the Calendar be used to track GDPR-specific deadlines such as DSAR response windows?
Yes. Compliance deadlines — including DSAR response deadlines, breach notification timelines, and DPIA review dates — can be added and tracked in the Calendar module. Filtering by category allows your team to focus specifically on regulatory deadline types when needed.
Can tasks be assigned to specific team members from the Calendar view?
Tasks can be created from the Calendar view and assigned to team members with active accounts in the Governance Solution. For more detailed task configuration — including linking to process records or risk assessments — open the full task record in the relevant module after creation.
See Also
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
- Website Visits vs Page Views vs Consent Explained
---
# How to Set Cookie Banner Target Audience in Secure Privacy – GDPR, CCPA, and LGPD Geographic Targeting
URL: https://support.secureprivacy.ai/article/cmp-v1-how-to-select-correct-target-audience-geotargeting
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T21:01:53.718+00:00
Reading Time: 2 minutes
Summary: [CMP v1] Learn how to configure geographic target audience settings in Secure Privacy — show GDPR, CCPA, or LGPD cookie banners only to visitors from Europe, California, or Brazil.
Secure Privacy's Target Audience setting lets you show your cookie consent banner and Privacy Center only to visitors from the relevant geographic region — so GDPR banners display to European visitors, CCPA banners to California visitors, and LGPD banners to Brazilian visitors. This ensures your compliance tools are shown to the right audience without interrupting visitors from other regions.
Who Is This For?
- Website owners and administrators configuring geographic targeting for their cookie consent banner
- Compliance teams ensuring GDPR, CCPA, or LGPD banners display only to the relevant regional audience
- Developers setting up multi-regulation compliance with region-specific banner visibility
How to Configure Cookie Banner Target Audience
- Log in to your Secure Privacy account and click the relevant compliance module in the left sidebar — GDPR, CCPA, or LGPD.
- Click the Targeting section tab and open the Target Audience dropdown.
- Select the appropriate audience option for the active compliance module:
- GDPR: Active for visitors from Europe
- CCPA: Active for visitors from California
- LGPD: Active for visitors from Brazil
Note: The available audience options change depending on which compliance module you have selected in the left sidebar.
- Click Save to apply the target audience setting.
Frequently Asked Questions
What happens to visitors outside the targeted region?
Visitors outside the targeted region will not see the cookie consent banner or Privacy Center for that compliance module. If you have multiple compliance modules active — for example, both GDPR and CCPA — each module displays its banner only to visitors within its respective target audience.
Can I show the cookie banner to all visitors regardless of location?
Yes. Select the Active for all visitors option from the Target Audience dropdown if you want the banner to display to every visitor regardless of their geographic location.
Do I need to configure targeting separately for each compliance module?
Yes. Target audience settings are configured independently for each compliance module — GDPR, CCPA, and LGPD each have their own Targeting section. Make sure to set and save the target audience for each module you have active in your account.
See Also
- Automatic Cookie Blocking Explained
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# How to Check If Google Consent Mode Is Working: Testing the gcs Parameter, Consent Mode Inspector & dataLayer
URL: https://support.secureprivacy.ai/article/checking-the-google-consent-mode-implementation
Product: Consent Management
Category: Google Consent Mode
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-04-15T21:48:41.548+00:00
Reading Time: 5 minutes
Summary: Verify your Google Consent Mode setup by checking the gcs parameter in Google Analytics collect requests, using the Consent Mode Inspector, and inspecting the dataLayer. Step-by-step guide by Secure Privacy.
Summary: This guide explains how to verify that Google Consent Mode is correctly implemented and working on your website using Secure Privacy. You'll learn how to identify the gcs parameter in Google Analytics network requests, compare tag behavior with and without consent, and use browser tools like the Consent Mode Inspector and window.dataLayer to confirm consent signals are firing correctly.
Who Is This Guide For?
- Website administrators and developers verifying their Google Consent Mode integration after setup
- Technical marketers and analytics managers checking that Google Analytics and Google Ads tags respond correctly to user consent
- Compliance professionals confirming GDPR-compliant tag behavior before go-live
Before You Begin
- Google Consent Mode must already be implemented on your site (via Basic or Advanced Mode)
- You have access to your browser's Developer Tools (Chrome DevTools recommended)
- Your Secure Privacy consent banner is live and rendering correctly on the page
How Google Consent Mode Changes Google Analytics Tag Behavior
Before testing, it helps to understand what changes once Google Consent Mode is active. By default, Google Consent Mode blocks Google tags from creating or reading any cookies until the user grants consent—similar to fully blocking the script, but with one key difference: a cookieless "collect" ping is still sent to Google Analytics.
Previously, without Consent Mode, Secure Privacy blocked the entire Google Analytics script when a user hadn't consented, meaning no network requests were made. With Google Consent Mode active, a lightweight collect API call is sent immediately—but it contains a special gcs parameter that signals the user's consent status to Google.
Quick Reference: gcs Parameter Values
- G100 — Consent Denied (default state, no cookies set)
- G101 — Analytics consent Granted
- G111 — All consent types Granted
How to Check Google Consent Mode Is Working: No Consent State
To verify correct behavior before a user consents, follow these steps:
- Open your browser's Developer Tools (F12 or right-click > Inspect).
- Clear all cookies for the site (Application tab > Storage > Clear site data).
- Reload the page without interacting with the consent banner.
- Go to the Network tab and filter for collect.
You should see a collect request sent to Google Analytics. This confirms Google Consent Mode is active. Unlike a non-Consent Mode implementation, this request fires even without consent—but no cookies are created.
The Google Analytics collect request visible in the Network tab before user consent is given — a sign that Google Consent Mode is active.
To inspect the request in detail, click the collect call and review its parameters:
The gcs=G100 parameter in the collect request confirms Google Consent Mode is active and consent is currently Denied.
The highlighted gcs parameter with a value of G100 confirms that Google Consent Mode is active and the current consent state is Denied. No cookies will be set in this state.
Verifying Google Consent Mode After the User Grants Consent
Once a user provides consent via the Secure Privacy banner, Google Consent Mode updates its status to Granted. This triggers the following changes:
- Cookies are created by Google Analytics and any other consented Google tags.
- The next collect API request will include gcs=G101 (analytics consent granted) or gcs=G111 (all consent types granted).
After the user grants consent, the gcs parameter updates to G101 or G111, confirming consent has been registered by Google Consent Mode.
Note: If you inspect a site without Google Consent Mode, you will only see the collect request after the user consents (when the script is loaded), and the gcs parameter will be absent entirely. The presence of gcs is your confirmation that Google Consent Mode is active.
Faster Verification: Consent Mode Inspector Browser Extension
For a quicker visual check of consent state without digging through DevTools, use the Consent Mode Inspector by InfoTrust. This Chrome extension displays the current Google Consent Mode state for all consent types at a glance directly in your browser toolbar.
The Consent Mode Inspector by InfoTrust displays the live consent status for each category—a fast alternative to manual DevTools inspection.
Verifying Consent Mode Defaults via the dataLayer
Google Consent Mode defaults and subsequent consent updates are also logged directly in the dataLayer. You can inspect these in your browser console by entering:
window.parent.dataLayerThis will display the full history of consent events—including the initial default consent state set by your Secure Privacy configuration and any updates triggered by user interaction with the banner.
The window.parent.dataLayer console output showing Google Consent Mode default state and consent update events.
Frequently Asked Questions (FAQ)
How do I know if Google Consent Mode is working correctly?
Open Chrome DevTools, go to the Network tab, and filter for collect. If you see a collect request with a gcs parameter present, Google Consent Mode is active. A value of G100 means consent is denied; G101 or G111 means consent has been granted.
What does the gcs parameter mean in Google Analytics?
The gcs parameter is added by Google Consent Mode to every collect API request. It indicates the current consent state: G100 = Denied, G101 = Analytics Granted, G111 = All Granted. Its absence means Google Consent Mode is not implemented.
Why do I see a collect request even when the user hasn't consented?
This is expected behavior in Google Consent Mode (especially Advanced Mode). A cookieless "collect" ping is sent to enable conversion and behavioral modeling without setting cookies or identifying the user. This is different from a standard Google Analytics implementation, which only fires after consent.
What is the Consent Mode Inspector and how do I use it?
The Consent Mode Inspector by InfoTrust is a free Chrome browser extension that visually displays the current Google Consent Mode state for each consent category on any page. Install it, visit your site, and click the extension icon to see a live readout of granted and denied consent states.
How do I check consent mode events in the dataLayer?
Open your browser console and type window.parent.dataLayer. Look for consent events to see the default state set at initialization and any updates recorded after user interaction with your consent banner.
Need Further Assistance?
For additional help verifying your Google Consent Mode implementation, contact our support team at support@secureprivacy.ai.
For urgent or systemic escalations related to Google Consent Mode, contact our designated point of contact: Andrew Sidorkin. We aim to address all escalations within one business day.
For policy questions directed to Google, contact the Google EU User Consent Policy team at ddp-gdpr-escalations@google.com.
---
# How to Implement Google Consent Mode Advanced with Google Tag Manager — Secure Privacy GTM Setup Guide
URL: https://support.secureprivacy.ai/article/implementing-google-consent-mode-advanced-using-google-tag-manager-community-template
Product: Consent Management
Category: Google Consent Mode
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-04-06T20:29:30.091+00:00
Reading Time: 5 minutes
Summary: Set up Google Consent Mode Advanced using Secure Privacy's GTM template. Step-by-step guide covering GCM v2, default consent states, cookieless pings, and GDPR compliance.
Summary: Google Consent Mode (GCM) is a Google API that lets website owners integrate user consent choices directly into Google tag behavior—ensuring privacy compliance via tools like Google Tag Manager (GTM) or the global site tag. This tutorial covers Advanced Consent Mode setup using the Secure Privacy GTM Community Template, including GCM v2's ad_user_data and ad_personalization parameters.
With Secure Privacy, Google Consent Mode can be implemented in two ways:
- Basic Mode
- Advanced Mode (this tutorial)
Who Is This Guide For?
- Website administrators managing consent banners and tag configuration
- Developers & technical marketers integrating Google Analytics or Google Ads via GTM
- Compliance and privacy professionals ensuring GDPR, CCPA, and Google EU User Consent Policy adherence
Before You Begin: Prerequisites
- An active Secure Privacy account with your Domain ID ready
- Access to your site's Google Tag Manager container
- If you are an existing Secure Privacy user using the GTM-native approach: remove the Secure Privacy script from the of your website before proceeding
- New users do not need to add the Secure Privacy script to the head tag
Why Use Google Consent Mode Advanced Mode?
Advanced Consent Mode gives you granular control over how Google tags behave based on each user's consent decision. For example, if a user declines analytics cookies, only aggregate, cookieless data is sent to Google—helping you balance privacy compliance with website performance measurement. Unlike Basic Mode, Advanced Mode enables conversion modeling and behavioral modeling even for non-consenting users, reducing data gaps in your analytics and advertising reporting.
GCM v2 expands support to five consent types—advertisement, analytics, functional, personalization, and security cookies—plus two new parameters: ad_user_data and ad_personalization.
How Secure Privacy Integrates with Google Consent Mode
Secure Privacy passes user consent choices directly to Google, ensuring your website only collects personal data with explicit user permission and falls back to aggregated, privacy-safe data when consent is declined. This keeps you compliant with GDPR and CCPA while maintaining user trust and advertising performance.
How to Set Up Google Consent Mode Advanced Using Google Tag Manager
Step 0: Set Up Google Tag Manager
Ensure Google Tag Manager is installed on your site before proceeding.
Step 1: Create a New Tag in Google Tag Manager
In your GTM container, navigate to Tags in the left sidebar, then click New.
Navigate to Tags in GTM and click New to create a new tag.
Step 2: Find the Secure Privacy Template in the Community Gallery
Click Tag Configuration, then select "Discover more tag types in the Community Template Gallery." Search for Secure Privacy in the gallery.
Search for "Secure Privacy" in the GTM Community Template Gallery.
Step 3: Add the Secure Privacy CMP Template to Your Workspace
Select the Secure Privacy CMP template from the results, then click Add to Workspace > Add.
Select the Secure Privacy CMP template and add it to your GTM workspace.
Step 4: Configure Your Secure Privacy Domain ID and Tag Settings
Insert your Secure Privacy Domain ID, configure any additional values as needed, and save the tag.
We have a quick giude on how to locate your Domain ID here.
Enter your Secure Privacy Domain ID and configure consent defaults.
Setting a Default Consent State (Recommended)
To configure a Default Consent Setting for each consent category:
- Click Add Setting.
- Select Granted or Denied from the dropdown for each consent category as required.
- Set the Region using ISO 3166-2 codes. Use all if you do not want to geo-target by region.
- Click Add to confirm.
Configure default Granted/Denied states per consent category and target region.
Step 5: Set the Trigger to "Consent Initialization – All Pages"
Under Triggering, select Consent Initialization – All Pages. This ensures the Secure Privacy consent signal fires before any other tags load—critical for correct Advanced Consent Mode behavior.
Set the trigger to "Consent Initialization – All Pages" for correct consent signal timing.
Step 6: Save and Publish
Click Save to finalize the tag configuration, then submit and publish your GTM container to make the integration live.
Optional: Blocking Third-Party Cookies in GTM
If your site loads third-party scripts through GTM, you may need to prevent those scripts from setting cookies when users have not granted consent. See: How to Block Cookies with Google Tag Manager.
Common Google Consent Mode Advanced Issues & Fixes
- Tag not firing as expected? Double-check the step order in GTM and confirm the trigger is set to Consent Initialization – All Pages—not a standard page view trigger.
- Consent choices not being reflected in Google tags? Verify your Secure Privacy Domain ID is entered correctly and that your consent categories are properly mapped in the tag configuration.
- Still not working? Check our troubleshooting knowledge base or contact the Secure Privacy support team directly.
Frequently Asked Questions (FAQ)
What is the difference between Basic and Advanced Google Consent Mode?
Basic Consent Mode blocks all Google tags until the user explicitly consents. Advanced Consent Mode loads tags immediately but sends only anonymous "cookieless pings" before consent is granted—enabling conversion and behavioral modeling while maintaining GDPR compliance. See our Basic vs. Advanced Consent Mode comparison guide.
Do I need to remove the Secure Privacy script from my site's when using GTM?
Yes—if you are an existing Secure Privacy user switching to the GTM-native approach, remove the Secure Privacy script from your site's to avoid conflicts. New users can skip this step.
What trigger should I use in GTM for Google Consent Mode?
Always use Consent Initialization – All Pages as the trigger. This guarantees the consent signal is sent before any other Google tags fire, which is required for Advanced Consent Mode to work correctly.
What are the new GCM v2 parameters and why do they matter?
GCM v2 adds ad_user_data and ad_personalization parameters, which give Google specific signals about whether a user has consented to their data being used for advertising personalization and audience targeting. These are required to maintain full ad functionality under Google's EU User Consent Policy.
Is Secure Privacy a Google-certified Consent Management Platform?
Yes. Secure Privacy is a Google-certified CMP, meeting Google's technical and policy standards for consent signal integration with Google tags, Analytics, and Ads.
Conclusion
By implementing Google Consent Mode Advanced with Secure Privacy's GTM Community Template, your website respects user consent decisions while remaining compliant with GDPR, CCPA, and Google's EU User Consent Policy. Advanced Mode ensures you retain the best possible analytics and advertising data through modeling—even when users decline consent.
Need Further Assistance?
Contact the Secure Privacy support team at support@secureprivacy.ai.
For urgent matters related to Google Consent Mode, email andrew@secureprivacy.ai — we aim to respond within one business day.
For policy questions directed to Google, contact the Google EU User Consent Policy team at ddp-gdpr-escalations@google.com.
See Also
- How to Block Cookies with Google Tag Manager
- Google Consent Mode – Basic Implementation Guide
- Ensuring Compliance with Google's EU User Consent Policy
- Basic vs. Advanced Google Consent Mode: Full Comparison Guide
---
# How to Integrate Google Consent Mode v2 with Secure Privacy – Installation Script and GTM Setup Guide
URL: https://support.secureprivacy.ai/article/cmp-v1-secure-privacy--google-consent-mode-v2-integration-guide-no-gtm
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T17:20:13.559+00:00
Reading Time: 3 minutes
Summary: [CMP v1] Learn how to integrate Google Consent Mode v2 with Secure Privacy using the installation script or Google Tag Manager Template — including default consent settings and region-specific configuration.
Secure Privacy supports Google Consent Mode v2 — an API that connects Google tag behavior with visitor consent choices. When integrated with Secure Privacy, every consent decision a visitor makes is automatically signaled to Google, adjusting how tags such as Google Analytics and Google Ads behave based on whether consent was granted or declined.
Google Consent Mode v2 (GCM v2) introduces two additional parameters alongside ad_storage and analytics_storage: ad_user_data and ad_personalization — giving you granular control over how personal data is used for advertising and personalization purposes.
Who Is This For?
- Privacy managers and compliance officers implementing GDPR-compliant consent management with Google tags
- Developers integrating Secure Privacy with Google Consent Mode via the installation script or GTM
- Marketing teams balancing analytics accuracy with visitor privacy compliance
How Google Consent Mode v2 Works with Secure Privacy
Google Consent Mode manages five consent categories: advertisement, analytics, functional, personalization, and security — using the global site tag or Google Tag Manager (GTM).
When a visitor declines analytics cookies, Google tags do not use cookies to collect personally identifiable information. Instead, aggregated, cookieless data is used — bridging privacy compliance with accurate conversion measurement. When integrated with Secure Privacy, consent signals are passed to Google automatically every time a visitor updates their preferences.
Integration Methods
There are two ways to integrate Google Consent Mode with Secure Privacy:
- Implementation using the installation script (without Google Tag Manager Template) — covered in this guide below.
- Implementation using Google Tag Manager Template — covered in the dedicated GTM integration guide.
Method 1: Implementation Using the Installation Script (Without GTM Template)
Step 1: Enable Google Consent Mode in Secure Privacy
- Log in to your Secure Privacy dashboard, select the target domain.
- Navigate to Installation > Google Consent Mode tab.
- Toggle the Enable Google Consent Mode switch to activate it.
Step 2: Add Default Consent Settings
- In the Google Consent Mode settings, locate the Default Consent Settings section.
- To set region-specific defaults, use the Add Setting option and enter the relevant ISO 3166-2 region code (for example, DE for Germany or US-CA for California).
- Configure the default consent state for each parameter — ad_storage, analytics_storage, ad_user_data, and ad_personalization — for the specified region.
- Click Add to save the setting. Repeat for each region you need to configure.
- Press Save button to apply the changes.
Method 2: Implementation Using Google Tag Manager Template
For detailed instructions on integrating Google Consent Mode v2 with Secure Privacy using the Google Tag Manager Community Template, refer to the dedicated guide: Secure Privacy: Integrate Google Consent Mode Using GTM Template.
Frequently Asked Questions
How do I enable Google Consent Mode in Secure Privacy?
Log in to the Secure Privacy dashboard, navigate to Installation > Google Consent Mode, and toggle Enable Google Consent Mode on. The integration will begin passing consent signals to Google automatically once activated.
How do I configure consent defaults for different regions?
Use the Add Setting feature in the Default Consent Settings section. Enter the ISO 3166-2 region code for the target region and configure the default consent state for each parameter. This allows you to apply different default behaviors — for example, setting analytics_storage to denied by default for EU visitors — based on geolocation.
What is the difference between Google Consent Mode v1 and v2?
Google Consent Mode v1 used two parameters: ad_storage and analytics_storage. v2 adds ad_user_data and ad_personalization — providing finer control over how user data is used for advertising and personalization. Google requires v2 compliance for continued access to certain features in Google Ads and Analytics as of March 2024.
Where can I find the GTM Template integration guide?
The full Google Tag Manager Template implementation guide is available here: Secure Privacy: Integrate Google Consent Mode Using GTM Template.
See Also
- Implementing Google Consent Mode Using Google Tag Manager Template
- Automatic Cookie Blocking Explained
- How to Increase Your Compliance Score (Overall Rating)
---
# Documents Module – Secure Compliance Document Storage, Version Control, and Access Management in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/governance-solution-core-module--documents
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T11:20:52.22+00:00
Reading Time: 3 minutes
Summary: Store, version-control, and manage access to compliance documents using the Documents module in Secure Privacy's Governance Solution — built for GDPR audit readiness.
The Documents module in Secure Privacy's Governance Solution is a secure, centralized repository for all compliance-critical documentation — from privacy policies and regulatory procedures to vendor contracts and training materials. It ensures your compliance assets are organized, accessible, version-controlled, and properly access-managed, supporting GDPR accountability and audit readiness across your organization.
Who Is This For?
- Data Protection Officers and privacy managers maintaining a centralized compliance document library
- Legal and compliance teams storing and controlling access to privacy policies, DPAs, and regulatory procedures
- IT and information security teams managing vendor contracts and technical security documentation
- HR and training teams storing staff data protection training materials and completion records
Purpose and Functionality
The Documents module gives compliance teams a single, secure location to store and manage every document that supports their privacy program. By centralizing document storage alongside access controls and version tracking, it eliminates scattered file storage, ensures only authorized personnel can access sensitive compliance assets, and provides an audit-ready record of your organization's compliance documentation at any point in time.
How to Use the Documents Module
- Navigate to the Documents page from the main navigation menu in the Governance Solution.
- Click Upload Document to add a new compliance document.
- Complete the required fields — including document name, description, owner, and department.
- Upload the document file.
- Configure permissions to control which team members can view, edit, or delete the document.
Available Features
- Secure document storage: Store all compliance-critical documents in an enterprise-grade secure repository, accessible only to authorized team members.
- Version control: Maintain a full version history for each document — ensuring the current version is always identifiable and previous versions are retained for audit purposes.
- Access control and permissions management: Define granular permissions per document — controlling who can view, edit, or delete each file based on role and department.
- Search and filtering: Quickly locate documents by name, owner, department, or document type — keeping your compliance library navigable as it grows.
Common Use Cases
- Storing and managing privacy policies, internal procedures, Data Processing Agreements, and regulatory compliance documents in a single controlled location.
- Tracking staff data protection training materials and maintaining completion records as evidence of GDPR accountability under Article 5(2).
- Providing organized, readily accessible evidence of compliance to supervisory authorities, auditors, and customers on request.
Troubleshooting
Cannot upload a document
Check the file size and format — the Documents module supports standard document formats and enforces file size limits. If your file exceeds the limit or is in an unsupported format, convert or compress it before uploading. If the issue persists, contact Secure Privacy support.
Cannot manage permissions
Managing document permissions requires administrative rights within the Documents module. Verify your user role with your Secure Privacy account administrator and request an update if needed.
Frequently Asked Questions
Can the Documents module store Data Processing Agreements and vendor contracts?
Yes. The Documents module is designed to store any compliance-critical document — including Data Processing Agreements, vendor contracts, privacy policies, DPIAs, and internal procedures. Permissions controls ensure sensitive contracts are only accessible to authorized team members.
How does version control work in the Documents module?
When a document is updated, the previous version is retained in the version history rather than overwritten. This ensures you always have access to prior versions for audit purposes — and can clearly identify which version of a policy or procedure was in effect at any given time.
Can documents stored in this module be used as evidence during a supervisory authority inspection?
Yes. The Documents module is designed to support audit readiness — providing a centralized, organized, and access-controlled record of your compliance documentation. Documents stored here can be retrieved quickly and presented to supervisory authorities, internal auditors, or customers as evidence of your organization's GDPR compliance program.
See Also
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
- Website Visits vs Page Views vs Consent Explained
---
# Process Register Module – GDPR Article 30 ROPA Documentation and Data Processing Activity Management in Secure Privacy's Governance Solution
URL: https://support.secureprivacy.ai/article/governance-solution-core-module--process-register
Product: Privacy & AI Governance
Category: Governance Solution
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T11:23:20.34+00:00
Reading Time: 4 minutes
Summary: Document and manage data processing activities with the Process Register module in Secure Privacy's Governance Solution — built for GDPR Article 30 ROPA compliance and audit readiness.
The Process Register module in Secure Privacy's Governance Solution is your central tool for documenting all data processing activities within your organization. Specifically designed to meet GDPR Article 30 Record of Processing Activities (ROPA) requirements, it ensures processing operations are accurately recorded, categorized, and linked to risk assessments — supporting compliance management, regulatory reporting, and audit readiness.
Who Is This For?
- Data Protection Officers and privacy managers responsible for maintaining GDPR Article 30 ROPA compliance
- Compliance and legal teams documenting data processing activities and their associated lawful bases
- IT and information security teams recording technical measures and retention periods for processing activities
- Process owners and department leads responsible for documenting the processing activities within their area
Purpose and Functionality
The Process Register module gives privacy and compliance teams a structured, centralized environment for building and maintaining their Record of Processing Activities. Each process entry captures the full range of GDPR Article 30 required fields — including purpose, data categories, retention periods, lawful basis, and technical measures — while integrating with the Governance Solution's risk assessment tools for end-to-end compliance traceability.
How to Use the Process Register Module
- Navigate to the Processes page from the main navigation menu in the Governance Solution.
- Click Add Process to create a new data processing activity record.
- Complete all required fields — including process name, processing purpose, data categories, data subject categories, retention period, lawful basis, and technical and organizational security measures.
- Assign a process owner and department to establish clear accountability for the processing activity.
- Link the process to any relevant risk assessments in the Privacy Risk Management module.
- Save the process record — it will appear in your ROPA and be available for regulatory reporting and audit purposes.
Available Features
- Detailed process documentation: Capture all GDPR Article 30 required fields for each processing activity — including purpose, legal basis, data categories, recipients, retention periods, and security measures.
- Categorization of processing activities: Organize processes by department, data subject type, or processing category to keep your ROPA structured and navigable as it grows.
- Assignment of responsibilities: Assign each process to an owner and department — ensuring clear accountability for maintaining and updating each processing activity record.
- Risk assessment integration: Link process records directly to risk assessments in the Privacy Risk Management module, creating end-to-end traceability from processing activity to identified risk to mitigation.
Common Use Cases
- Building and maintaining a complete, accurate Record of Processing Activities (ROPA) as required by GDPR Article 30 — ready for supervisory authority inspection at any time.
- Identifying and assessing privacy risks associated with specific processing activities — feeding into DPIA pre-screening and the Privacy Risk Management module.
- Demonstrating processing transparency and compliance accountability to supervisory authorities, auditors, and customers through organized, readily accessible process documentation.
Troubleshooting
Cannot add a new process
Verify that your account has the necessary permissions to create entries in the Process Register module. Only users with the appropriate role can add new processing activities. Contact your Secure Privacy account administrator to review and update your access rights.
Risk assessment integration is not working
Check that risk assessment records exist in the Privacy Risk Management module and that your account has the permissions needed to link records across modules. If the issue persists after verifying settings, contact Secure Privacy support with details of the process record and the risk you are attempting to link.
Frequently Asked Questions
Does the Process Register module satisfy GDPR Article 30 ROPA requirements?
Yes. The module is specifically designed to capture all fields required under GDPR Article 30(1) for controllers — including the name and contact details of the controller and DPO, processing purposes, data categories, data subject categories, recipients, international transfers, retention periods, and security measures. Records can be exported for regulatory reporting and supervisory authority submission.
Can multiple team members contribute to the same process record?
Yes. Process records can be assigned to an owner and department, and team members with appropriate permissions can edit and update records as processing activities evolve. Your DPO or privacy manager retains oversight of the register as a whole through the Governance Solution.
How often should process records be reviewed and updated?
Process records should be reviewed whenever the associated processing activity changes — including new data categories, updated retention periods, new recipients, or changes to technical security measures. A full ROPA review should also be conducted as part of your annual compliance audit to ensure all records remain accurate and current.
See Also
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
- Website Visits vs Page Views vs Consent Explained
---
# How to Add a Custom Cookie or Service to Your Secure Privacy Scan Report – Manual Classification Guide
URL: https://support.secureprivacy.ai/article/cmp-v1-how-do-i-add-a-custom-servicecookie
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T17:09:20.879+00:00
Reading Time: 2 minutes
Summary: [CMP v1] Learn how to manually add a custom cookie or service to your Secure Privacy scan report using the Classification tab — ensuring accurate detection, classification, and blocking for all tracking technologies.
If a specific cookie or service is not automatically detected by Secure Privacy's scanning engine, you can manually add it to your scan report using the Classification tab. This ensures accurate detection, classification, and blocking for cookies that fall outside standard auto-detection — keeping your cookie declaration complete and your compliance posture current.
Who Is This For?
- Website administrators adding custom or non-standard cookies not detected by the automatic scanner
- Compliance teams ensuring all active cookies and services appear in the scan report and cookie declaration
- Developers adding known third-party services that require manual classification and blocking configuration
How to Add a Custom Cookie or Service to Your Scan Report
- Log in to your Secure Privacy dashboard and navigate to the Classification tab for your website.
- Click Add Custom Cookie or Add Custom Service — depending on whether you are adding an individual cookie or a broader service.
- Enter the required details — including the cookie or service name, category, description, and any relevant domain or URL information.
- Save the entry. The custom cookie or service will now appear in your classification list.
- Navigate to Scan Report > Rescan Website to apply your changes and verify the custom entry appears correctly in your updated scan report.
Keep Your Scan Report Accurate and Up to Date
Manually adding known cookies and services ensures your scan report, cookie declaration, and privacy policy accurately reflect all tracking technologies active on your website — including those not yet covered by Secure Privacy's automatic detection. Keeping your classification list current is essential for demonstrating GDPR and ePrivacy compliance to regulators and website visitors.
Frequently Asked Questions
Why might a cookie or service not be detected automatically?
Secure Privacy's scanner detects cookies based on its known service database. Custom-built tracking solutions, newer third-party services, or cookies set through non-standard implementations may not yet be in the automatic detection database. Manually adding them ensures they are classified, declared, and blocked correctly.
What information do I need to add a custom cookie?
You typically need the cookie name, the domain it is associated with, its category (e.g., Analytics, Marketing, Functional), and a brief description of its purpose. This information appears in your cookie declaration and helps visitors understand what each cookie does before giving or withholding consent.
Do I need to rescan after adding a custom cookie or service?
Yes. After saving a custom entry in the Classification tab, trigger a rescan from Scan Report > Rescan Website to apply the changes. The rescan ensures your updated classification is reflected in your live cookie declaration and blocking configuration.
See Also
- How to Block a Cookie in the Scan Report
- Understanding Cookie Classification in Secure Privacy
---
# How to Set Up a Privacy & Cookie Policy in Secure Privacy – Generate, Edit, Embed, and Manage Your Cookie Declaration
URL: https://support.secureprivacy.ai/article/cmp-v1-how-to-set-up-a-cookie-declaration-on-your-website
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T19:27:48.639+00:00
Reading Time: 5 minutes
Summary: [CMP v1] Learn how to generate, customize, and embed a Privacy & Cookie Policy in Secure Privacy — including cookie declaration editing, section management, multi-language support, and three embed options.
The Privacy & Cookie Policy feature in Secure Privacy lets you generate, customize, and embed a GDPR-compliant privacy policy and cookie declaration on your website — automatically populated with cookie and plugin data from your latest scan results. This guide covers every available option: generating, editing, resetting, adding sections, managing languages, embedding, and enabling or disabling the policy.
Note: This feature is available on Plus, Business, and Enterprise plans. See all available features on the Secure Privacy pricing page.
Who Is This For?
- Website owners and administrators generating and managing a GDPR-compliant cookie policy with Secure Privacy
- Privacy officers editing cookie declaration text and adding custom sections for their organization
- Developers embedding the privacy and cookie policy on website pages using button, hyperlink, or full-page embed options
How to Generate Your Privacy & Cookie Policy
- Log in to your Secure Privacy account.
- Click Privacy & Cookie Policy in the left sidebar.
- Click Generate new privacy policy and then Next.
- Answer the questions by completing the required fields — these responses personalize your policy.
- Click Save all to generate your personalized Privacy & Cookie Policy.
Note: Cookie and plugin data inside the Privacy & Cookie Policy — such as content under "With whom we share the collected personal information" — is generated automatically from your latest scan results and updates whenever you rescan your domain.
How to Reset Your Privacy & Cookie Policy
- Log in to your Secure Privacy account.
- Click Privacy & Cookie Policy in the left sidebar, then click Generator.
- Click Reset my choices to revert all policy settings back to their defaults.
- Generate a new policy by answering the questions, completing required fields, and clicking Next.
How to Edit Text Inside the Cookie Declaration
- Log in to your Secure Privacy account.
- Click Privacy & Cookie Policy in the left sidebar, then click Preview and edit.
- Click the Cookie Declaration tab to switch to edit mode for your auto-generated cookie policy.
- Select the Language you want to edit before making any changes.
- Scroll to the section you want to edit and click on it.
- Click anywhere inside the text field to begin editing. The default text is pre-aligned with applicable legislation — only edit where legally necessary.
- Click the small green tick in the upper corner of the text field to save and confirm your changes.
Note: Cookie and plugin data within the Cookie Declaration — including auto-generated section names such as "Social media cookies" and "Analytics cookies" — cannot be edited manually. Only the description text within those sections is editable. These sections update automatically with each rescan.
How to Add a New Section to Your Cookie Declaration
- Log in to your Secure Privacy account.
- Click Privacy & Cookie Policy in the left sidebar, then click Preview and edit.
- Click the Cookie Declaration tab to switch to edit mode.
- Select the Language before proceeding.
- Click Add Section at the top of the editor to insert a new section at the beginning of the policy, or at the bottom to attach it at the end.
- In the Add Section modal window, enter a Heading and Description for the new section, then click Save.
Note: Moving sections within the policy is not currently supported but is planned for a future release.
How to Change Language or Add a New Language to Your Policy
- Log in to your Secure Privacy account and click Language in the left sidebar.
- Select the languages you want to add to your account.
- Check the Active languages list on the right to see which languages are already installed.
- Click Save to apply your language settings.
How Visitors Access Your Privacy & Cookie Policy on Your Website
After providing consent, visitors will see the Privacy & Cookie Center button in the bottom-left corner of your website. When clicked, a modal window opens where visitors can:
- Change the Language of the Privacy & Cookie Center displayed
- Access the Cookie Declaration under its corresponding tab
Note: The icon and color scheme of the Trust Badge can be configured in your dashboard and may differ from the default appearance.
Embed Options for Your Privacy & Cookie Policy
Secure Privacy provides three ways to embed your Privacy & Cookie Policy on your website. All embed options allow you to select the display language and preview the element before copying the code.
Option 1: Button embed
Displays a clickable button that opens your Privacy & Cookie Policy. Configure the button text and copy the shortcode to paste into the HTML or source code of your page.
Option 2: Hyperlink embed
Displays a text hyperlink to your Privacy & Cookie Policy. Configure the hyperlink text and copy the link code to paste into the HTML or source code of your page.
Option 3: Embed on website (full page)
Embeds your complete Privacy & Cookie Policy as a full-page element within a page on your website. Copy the embed code and paste it into the HTML or source code of your chosen page.
How to Enable or Disable the Cookie Declaration
- Log in to your Secure Privacy account and click Privacy & Cookie Policy in the left sidebar.
- Click Use on website.
- Toggle Enable cookie policy to enable (green) or disable (gray) the Cookie Declaration on your website or domain.
Frequently Asked Questions
Can I edit the auto-generated cookie category sections in the Cookie Declaration?
You can edit the description text within auto-generated sections, but the section names — such as "Analytics cookies" or "Social media cookies" — and the cookie/plugin data within them are generated automatically from your scan results and cannot be edited manually. These sections update whenever you rescan your domain.
What happens if I reset my Privacy & Cookie Policy?
Resetting reverts all your generator answers to their defaults. Any manually edited text in the Preview and edit section will be lost when you regenerate the policy. Save any custom content you want to keep before clicking Reset my choices.
Which plan do I need to use the Cookie Declaration feature?
The Privacy & Cookie Policy and Cookie Declaration features are available on Plus, Business, and Enterprise plans. See the full feature comparison on the Secure Privacy pricing page.
See Also
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# How to Increase Your GDPR Compliance Score in Secure Privacy – Recommended Actions Guide
URL: https://support.secureprivacy.ai/article/cmp-v1-increase-compliance-score-with-secure-privacy-cmp
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T17:11:19.384+00:00
Reading Time: 5 minutes
Summary: [CMP v1] Learn how to improve your Secure Privacy Overall Rating by completing GDPR recommended actions — covering cookie blocking, consent banners, privacy policy, SSL, and data transfer compliance.
If your Overall Rating under the Report tab is low, Secure Privacy provides a prioritized list of Recommended actions for GDPR compliance for your website. Working through these actions — particularly items marked with a red X — is the fastest way to improve your GDPR compliance score and close the most critical gaps.
Who Is This For?
- Website owners and administrators responsible for managing GDPR compliance on their sites
- Compliance officers reviewing and improving their Secure Privacy Overall Rating
- Web developers implementing cookie blocking, SSL, and consent banner configurations
How to Review Your GDPR Recommended Actions
Navigate to the Report tab in your Secure Privacy dashboard. The Recommended actions for GDPR on [your website] section highlights the steps needed to improve your compliance score. Focus first on items flagged with a red X — these indicate the highest-priority compliance gaps.
Configure Blocking on Unblocked Cookies
This action indicates that one or more cookies on your website are not being blocked before visitor consent is obtained. First, verify that your Secure Privacy installation is correctly set up for your website's technology stack.
If your installation is correct but blocking issues persist, follow the guide on blocking specific cookies or services to manually configure blocking for the affected services.
Personal Data Transmitted to Third Countries — Adequacy Check
The report flags whether personal data is being sent to countries outside the EU that may not meet the European Commission's adequacy requirements. Review the applicable guidance:
- EDPS guidance on international data transfers
- European Commission adequacy decisions
If data is being transmitted to a non-adequate country, ensure an appropriate transfer mechanism is in place — such as Standard Contractual Clauses — before the transfer continues.
Enable the Cookie Consent Banner on Your Website
A cookie consent banner is required under the ePrivacy Directive and GDPR to inform visitors about cookie use and obtain their prior consent before non-essential cookies are loaded. If this action is flagged, your banner may not be enabled or correctly configured.
For setup instructions, refer to the Knowledge Base article on cookie banners. Note that banner configuration options depend on your active compliance module.
Add a Preference Center to Display Services on Your Website
The Preference Center gives website visitors a centralized location to view all privacy documents, understand your data practices, and manage their consent choices. It also simplifies compliance management by consolidating all privacy-related information in one place.
Note: Preference Center settings are specific to each compliance module — configure it within the module applicable to your website.
Enable Privacy Policy on Your Website
A privacy policy is a legal requirement under GDPR, informing visitors about how their personal data is collected, processed, and stored. If this action is flagged, your privacy policy may not be enabled or displayed correctly on your website.
Enable SSL on Your Website
An SSL certificate encrypts data transmitted between your website and its visitors, verifies site ownership, prevents fraudulent site impersonation, and builds visitor trust. If this action is flagged, contact your website administrator or domain provider to obtain and install an SSL certificate for your domain.
Common Issues and Fixes
Low Overall Compliance Score
Ensure Secure Privacy is correctly installed on your website and that all recommended actions above have been completed. Incomplete actions — particularly unblocked cookies and missing consent banners — have the greatest impact on your Overall Rating.
Cookies not blocking correctly
Verify that your blocking setup matches your website technology stack. If auto-blocking is not covering specific cookies, use the manual tag blocking configuration in Classification > Tag Blocking. See the cookie blocking guide for step-by-step instructions.
International data transfer compliance issues
Confirm that all personal data transfers to third countries are covered by an appropriate GDPR Chapter V transfer mechanism — either an adequacy decision or Standard Contractual Clauses. Review the flagged transfers in your scan report and apply the correct safeguard for each.
Cookie consent banner not displaying
Check that the cookie banner is enabled in your compliance module settings and that the Secure Privacy script is correctly installed on your website. If the banner is configured but not appearing, verify there are no Content Security Policy (CSP) conflicts blocking the banner from loading.
Frequently Asked Questions
What does the Overall Rating in Secure Privacy measure?
The Overall Rating reflects your website's current GDPR compliance posture based on the scan results — including cookie blocking coverage, consent banner presence, privacy policy availability, SSL status, and international data transfer compliance. Each flagged action with a red X reduces your score and represents a specific compliance gap that needs to be addressed.
How often should I review my Recommended Actions?
Review your Recommended Actions whenever you make changes to your website — such as adding new plugins, third-party services, or marketing scripts. A full rescan should be triggered after any significant change, and a routine check is recommended at least quarterly as part of ongoing compliance management.
Will completing all recommended actions guarantee full GDPR compliance?
Completing all recommended actions significantly improves your compliance posture and closes the most common technical gaps. However, GDPR compliance is broader than technical configuration — it also encompasses internal policies, staff training, data processing documentation, and vendor management. The Secure Privacy recommendations address the website-level compliance layer.
See Also
- How to Block a Cookie in the Scan Report
- How to Change the CSS of Your Cookie Consent Banner
- Ongoing Checkups: Best Practices
- Automatic Cookie Blocking Explained
---
# Automatic Cookie Blocking Explained – How Secure Privacy Blocks Scripts, Pixels, and Iframes for GDPR Compliance
URL: https://support.secureprivacy.ai/article/cmp-v1-automatic-cookie-blocking-explained--secure-privacy-cmp
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T17:16:40.869+00:00
Reading Time: 5 minutes
Summary: [CMP v1] Learn how Secure Privacy's automatic cookie blocking engine works — including v1 vs v2 blocking modes, how scripts, pixels, and iframes are blocked, and how to manually add custom blocking rules.
Secure Privacy's automatic cookie blocking engine scans your website, identifies all cookies and third-party services, and generates a domain-specific blocking configuration that prevents non-essential cookies from loading until visitor consent is given. This article explains how the blocking mechanism works, the available blocking modes, and how to manually add scripts, pixels, or iframes to your blocking configuration.
Who Is This For?
- Website administrators setting up or reviewing automatic cookie blocking in Secure Privacy
- Developers understanding the technical mechanism behind script, pixel, and iframe blocking
- Compliance teams verifying that non-essential cookies are correctly blocked before visitor consent
How the Secure Privacy Cookie Blocking Engine Works
The Secure Privacy scanner crawls your website and identifies all cookies and third-party services. You can view the full results in the Scan Report inside your dashboard.
Based on the scan results, Secure Privacy generates a unique JavaScript file for each domain. This file contains the full list of scripts, pixels, and iframes to block — and is editable through the Classification screen in your dashboard:
Use the Classification screen to add or remove custom scripts from your blocking configuration. Each time you save, the JavaScript blocking file is updated with the latest list.
Automatic Cookie Blocking
When auto-blocking is enabled, Secure Privacy blocks all non-essential cookies from being set on a visitor's device until explicit consent is received. Essential cookies — those required for basic website functionality — are always permitted.
Blocking Modes Explained
Secure Privacy offers three blocking modes. Choose the mode that matches your website's compliance requirements:
Blocking Mode
Description
Recommended For
v2 Blocking (Current)
Secure Privacy's current automatic blocking method. Prevents all non-essential cookies from being set until explicit user consent is given. Only cookies classified as essential — required for basic website functionality — are permitted without consent.
All new users — recommended for maximum GDPR compliance
v1 Blocking (Legacy)
An older blocking mechanism maintained for backward compatibility with existing systems. Less robust and feature-rich than v2. Not recommended for new implementations.
Existing installations using v1 only — migrate to v2 when possible
Disabled Blocking
No automatic blocking is applied. All cookies and services may load freely until the user actively intervenes. Used in manual blocking scenarios where the website owner manages blocking directly.
Manual blocking configurations only
Prerequisites for Automatic Cookie Blocking
Auto-blocking relies on your scan results and cookie categorizations. If a cookie is undetected or uncategorized in your scan report, it will not be blocked automatically. Always trigger a fresh rescan of your website before enabling auto-blocking to ensure all cookies are detected and correctly categorized.
Technical Blocking Mechanism
Each cookie-setting script is tracked in your domain's unique JavaScript blocking file using the MutationObserver API — compatible with all major browsers including IE11. This observer monitors script loading patterns in real time and intercepts them before they execute, holding them until the visitor provides consent.
How Blocking Works for Scripts, Pixels, and Iframes
- Pixels: When automatic blocking is enabled, all pixel trackers are blocked by default and only added to the HTML DOM after the visitor has given explicit consent for the relevant category. For example, a Facebook Pixel remains inactive until the user approves marketing cookies.
- Scripts: Scripts are prevented from being injected into the HTML DOM until the user grants consent. For example, Google Analytics scripts will not load before approval — which may result in reduced analytics data until consent is given.
- Iframes: Blocked iframes are managed via the Iframe tab in the blocking configuration settings. Secure Privacy automatically blocks these iframes and displays an overlay informing the visitor that the content is blocked, along with a consent button allowing them to enable it.
How to Manually Block a New Script, Pixel, or Iframe
If a specific script, pixel, or iframe is not covered by automatic blocking, use the Add Tag Blocking form in the Classification screen. Specify the type — Script, Iframe, or Pixel — and enter the source URL or domain to add it to your blocking configuration.
Frequently Asked Questions
What is the difference between v1 and v2 blocking in Secure Privacy?
v2 blocking is Secure Privacy's current, recommended blocking method. It uses a more advanced detection and interception mechanism that blocks all non-essential cookies before consent — including dynamically injected scripts. v1 blocking is a legacy method maintained for backward compatibility but lacks the robustness of v2. New users should always use v2 blocking.
Why are some cookies not being blocked automatically?
Auto-blocking only applies to cookies and services that have been detected and categorized in your scan report. If a cookie is not in your scan results — because it was added after your last scan or uses a non-standard implementation — it will not be blocked automatically. Trigger a rescan and check the Classification screen to ensure all active cookies are categorized. Use the Add Tag Blocking form to manually add any that are still missing.
Does disabling blocking mean cookies will load without consent?
Yes. When blocking is set to Disabled, Secure Privacy does not automatically restrict any cookies or services — all may load freely unless you have configured manual blocking for specific tags. This mode is only appropriate for websites using a fully manual blocking approach where the operator controls all cookie loading directly.
See Also
- How to Set Up and Install Secure Privacy
- Block Cookies Manually in Secure Privacy Scan Report
- How to Increase Your Compliance Score (Overall Rating)
- Do I Need to Block All Cookies?
---
# How to Set Up a Privacy Policy in Secure Privacy – Generate, Edit, Embed, and Manage Your GDPR Privacy Policy
URL: https://support.secureprivacy.ai/article/cmp-v1-how-to-set-up-a-privacy-policy-on-your-website
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T18:09:07.869+00:00
Reading Time: 5 minutes
Summary: [CMP v1] Learn how to generate, customize, and embed a GDPR privacy policy using Secure Privacy — including text editing, section management, multi-language support, and three embed options.
The Privacy Policy generator in Secure Privacy lets you create, customize, and embed a GDPR-compliant privacy policy on your website — populated automatically with cookie and plugin data from your latest scan results. This guide covers every available configuration option: generating, editing, resetting, translating, and embedding your privacy policy.
Note: The Privacy Policy feature is available on Plus, Business, and Enterprise plans. See all available features on the Secure Privacy pricing page.
Who Is This For?
- Website owners and administrators setting up a GDPR-compliant privacy policy with Secure Privacy
- Privacy officers customizing policy text, sections, and languages for their organization
- Developers embedding the privacy policy on website pages using button, hyperlink, or full-page embed options
How to Generate a Privacy Policy
- Log in to your Secure Privacy account.
- Click Privacy & Cookie Policy in the left sidebar.
- Click Generate new privacy policy and then Next.
- Answer the questions by completing the required fields — these responses are used to personalize your policy.
- Click Save all to generate your personalized privacy policy.
Note: Cookie and plugin data inside the privacy policy — such as content under "With whom we share the collected personal information" — is generated automatically based on your latest scan results. This section updates whenever you rescan your domain.
How to Reset Your Privacy Policy
- Log in to your Secure Privacy account.
- Click Privacy & Cookie Policy in the left sidebar, then click Generator.
- Click Reset my choices to revert all policy settings back to defaults.
- Generate a new policy by answering the questions, completing the required fields, and clicking Next.
How to Edit Text Inside Your Privacy Policy
- Log in to your Secure Privacy account.
- Click Privacy & Cookie Policy in the left sidebar, then click Preview and edit.
- Select the Language you want to edit before making any changes.
- Click the section you want to edit.
- Click anywhere inside the text field to begin editing. The default text has been pre-aligned with applicable privacy legislation — only make changes where legally necessary.
- Click the small green tick in the upper corner of the text field to save and confirm your changes.
Note: System-generated sections — such as the cookie and plugin data under "With whom we share the collected personal information" — are populated automatically from scan results and cannot be edited manually.
How to Add a New Section to Your Privacy Policy
- Log in to your Secure Privacy account.
- Click Privacy & Cookie Policy in the left sidebar, then click Preview and edit.
- Click Add Section at the top of the editor to insert a new section at the beginning of the policy.
- Alternatively, click Add Section at the bottom of the policy text to attach the new section at the end.
Note: Moving sections within the policy is not currently supported, but is planned for a future release.
How to Change Language or Add a New Language
- Log in to your Secure Privacy account and click Language in the left sidebar.
- Select the languages you want to add to your account.
- Check the Active languages list on the right to see which languages are already installed.
- Click Save to apply your language settings.
How Visitors Access Your Privacy Policy on Your Website
Visitors on your website will see the Privacy Center button in the bottom-left corner of every page. When clicked, it opens a pop-up where visitors can:
- Change the Language of the Privacy Center and policy displayed
- View your full Privacy Policy under the corresponding tab
Embed Options for Your Privacy Policy
Secure Privacy provides three ways to embed your privacy policy on your website. All embed options allow you to select the display language and preview how the element will appear before copying the code.
Option 1: Button embed
Displays a clickable button that opens your privacy policy. Configure the button text and copy the shortcode to paste into the HTML or source code of your page.
Option 2: Hyperlink embed
Displays a text hyperlink to your privacy policy. Configure the link text and copy the link code to paste into the HTML or source code of your page.
Option 3: Embed on website (full page)
Embeds your complete privacy policy as a full-page element directly within a page on your website. Copy the embed code and paste it into the HTML or source code of your chosen page.
How to Enable or Disable Your Privacy Policy
- Log in to your Secure Privacy account and click Privacy & Cookie Policy in the left sidebar.
- Click Use on website.
- Toggle Enable privacy policy to enable or disable the privacy policy on your website or domain.
Frequently Asked Questions
Can I edit the cookie and plugin data sections of my privacy policy?
No. The sections populated with cookie and plugin data — such as "With whom we share the collected personal information" — are generated automatically from your scan results and cannot be edited manually. To update this data, trigger a new website rescan from the Scan Report page.
What happens to my privacy policy if I reset my choices?
Resetting reverts all your policy generator answers to their defaults. Your previously generated policy will be replaced when you complete the generator again. Any manual text edits made in Preview and edit will be lost — ensure you have saved any custom content before resetting.
Which plan do I need to use the Privacy Policy feature?
The Privacy Policy generator and embed features are available on Plus, Business, and Enterprise plans. See the full feature comparison on the Secure Privacy pricing page.
See Also
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# Google Consent Mode: Basic vs Advanced — Complete Guide for GDPR & CCPA Compliance
URL: https://support.secureprivacy.ai/article/basic-vs-advanced-google-consent-mode-full-comparison-guide
Product: Consent Management
Category: Google Consent Mode
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-23T21:29:58.851+00:00
Reading Time: 6 minutes
Summary: Understand the difference between Google Consent Mode Basic and Advanced—cookieless pings, conversion modeling, GDPR compliance, and how Secure Privacy's certified CMP simplifies setup.
Summary: Google Consent Mode lets websites adjust how analytics and advertising tags behave based on each user's consent choices. This guide explains how Basic and Advanced Consent Mode differ in data collection, conversion modeling, privacy compliance, and tag behavior—and how Secure Privacy's Google-certified consent management platform (CMP) makes implementation seamless.
Who Is This Guide For?
This article is intended for website administrators, marketers, developers, compliance managers, and privacy officers who manage analytics, user privacy, and regulatory requirements under frameworks such as GDPR and CCPA.
Key Takeaways
- Basic Consent Mode blocks all Google tags until the user explicitly consents—maximum privacy, but significant analytics data gaps.
- Advanced Consent Mode loads tags immediately and sends anonymous "cookieless pings" before consent, enabling conversion and behavioral modeling while remaining privacy-compliant.
- Both modes help websites meet GDPR, CCPA, and Google's EU User Consent Policy requirements.
- Secure Privacy is a Google-certified CMP that supports both modes with a code-free, guided setup.
What Is Google Consent Mode?
- Google Consent Mode is a privacy framework that integrates with your consent banner, giving your website precise control over how Google tags (Google Analytics, Google Ads, etc.) operate based on a user's consent decision.
- It helps websites comply with privacy laws such as GDPR and CCPA, while still capturing valuable—even if limited—analytics and advertising insights through modeling.
Understanding Google Consent Mode: Basic Mode
- Simple Setup: Basic Consent Mode is quick and beginner-friendly. Minimal configuration makes it ideal for teams that want a straightforward, privacy-first solution without deep technical integration.
- Strict Data Practices: Google tags only fire when users explicitly grant consent. If users do not consent, no data—including the consent status itself or any page events—is sent to Google. This ensures maximum user privacy, but results in significant analytics data blind spots.
- Conversion Modeling (Limited): Google can provide broad conversion estimates for non-consenting users, but without behavioral data, important optimization insights are lost.
For step-by-step setup instructions, see Implementing Google Consent Mode in Basic Mode.
Understanding Google Consent Mode: Advanced Mode
- Granular Tag Control: Advanced Consent Mode gives you full configuration of tag behavior for every user consent state—granted, denied, or pending. This allows customized compliance while maximizing data opportunities within privacy boundaries.
- Preemptive Tag Loading: Google tags load as soon as a user lands on your site. If consent is not yet granted, only "cookieless pings"—tiny, non-identifying data packets—are sent to Google's servers, enabling privacy-compliant analytics while awaiting user action.
- Enhanced Conversion & Behavioral Modeling: Advanced Consent Mode enables both conversion modeling and behavioral modeling, even when users do not consent—giving you aggregated insights for marketing optimization without violating privacy laws.
- Conversion modeling uses existing consented data to estimate conversions for non-consenting users, providing a more complete picture of your marketing funnel's effectiveness.
- Behavioral modeling analyzes aggregated user actions to understand browsing patterns and support website optimization. By understanding how users interact with your site, you can improve personalization and conversion rates—without identifying individuals.
How Google tag behavior and data collection differ between Basic and Advanced Consent Mode.
For expert setup using Google Tag Manager, see Implementing Google Consent Mode in Advanced Mode using Google Tag Manager.
How Google Consent Mode Affects Analytics: Real-World Scenarios
Scenario 1: Basic Consent Mode – User Does Not Consent
- Tag Behavior: All Google tags are blocked entirely until the user grants consent.
- Data Impact: No network requests—not even the consent status—are sent to Google. Your analytics and advertising tools will have significant data gaps, with only limited conversion modeling available and no user journey or engagement metrics.
- Privacy Level: This is the strictest implementation, offering users total privacy at the cost of actionable analytics data.
Scenario 2: Advanced Consent Mode – User Does Not Consent ("Cookieless Pings")
- Tag Behavior: Google tags load on all pageviews. When a user denies consent, only "cookieless pings"—basic, functional, non-identifiable signals—are transmitted to Google's servers.
- Data Impact: These pings enable enhanced conversion modeling and some behavioral analysis. While full consent-based data isn't available, you still gain pageview and funnel information to aid optimization and advertising—without breaching privacy laws.
- Privacy Level: User anonymity and regulatory compliance are fully maintained, with significantly higher data utility than Basic Mode.
Basic vs Advanced Google Consent Mode: Which Should You Choose?
Feature
Basic Consent Mode
Advanced Consent Mode
Setup complexity
Low – beginner-friendly
Moderate – code-free with Secure Privacy
Tags fire without consent?
No
Yes (cookieless pings only)
Conversion modeling
Limited
Enhanced
Behavioral modeling
Not available
Available
GDPR / CCPA compliant
Yes
Yes
Analytics data gaps
Significant
Minimal
Best for
Strict privacy-first sites
Data-driven marketing teams
Always clearly inform users how their data is used and ensure compliance with all applicable privacy regulations, including GDPR and CCPA.
Common Google Consent Mode Issues & Fixes
- Google tags not firing: Verify your Secure Privacy consent banner integration and Google Tag Manager placement. Confirm that the consent mode signals are being passed correctly before tag execution.
- Missing analytics or conversion data: Switch to Advanced Consent Mode to enable cookieless pings and improve reporting accuracy for non-consenting users.
- Custom consent states not working: Review Secure Privacy's consent mode verification guide, or contact our support team for a personalized review.
Frequently Asked Questions (FAQ)
What is the difference between Basic and Advanced Google Consent Mode?
Basic Consent Mode blocks all Google tags until a user explicitly consents, resulting in data gaps. Advanced Consent Mode loads tags immediately but only sends anonymous cookieless pings before consent is given, enabling better conversion and behavioral modeling while remaining GDPR-compliant.
Is Google Consent Mode required for GDPR compliance?
Google Consent Mode is not legally required by GDPR itself, but it is required by Google for advertisers using Google Ads and Analytics in the European Economic Area (EEA). It is a key part of meeting Google's EU User Consent Policy and maintaining ad personalization features.
What are "cookieless pings" in Google Consent Mode?
Cookieless pings are small, non-identifying data signals sent to Google when a user has not consented. They contain no personal data or cookies, but help Google model conversion activity and browsing patterns in an aggregated, privacy-safe way. They are only sent in Advanced Consent Mode.
Is Secure Privacy a Google-certified Consent Management Platform?
Yes. Secure Privacy is a Google-certified CMP, meaning it meets Google's technical and policy standards for consent signal integration with Google tags, Analytics, and Ads.
Can I switch from Basic to Advanced Consent Mode later?
Yes. You can upgrade from Basic to Advanced Consent Mode at any time. Secure Privacy's platform supports both modes and offers a code-free setup for Advanced Mode via Google Tag Manager.
Need Further Help? Escalations & Google CMP Certification Support
For additional support, contact our team at support@secureprivacy.ai.
For urgent or systemic escalations related to Google Consent Mode, contact our designated escalation point: Andrew Sidorkin. We aim to respond to all escalations within one business day.
For policy questions directed to Google, contact the Google EU User Consent Policy team at ddp-gdpr-escalations@google.com.
See Also
- Implementing Google Consent Mode in Basic Mode
- Implementing Google Consent Mode in Advanced Mode using Google Tag Manager
- Global Privacy Platform (GPP) Setup | Secure Privacy Guide
- Secure Privacy — Google-Certified Consent Management Platform
- Checking Your Google Consent Mode Implementation
---
# How to Enable the Detailed Cookie Banner in Secure Privacy – Advanced Cookie Consent Banner Setup
URL: https://support.secureprivacy.ai/article/cmp-v1-how-to-enable-detailedadvanced-cookie-banner-with-data-categories-shown
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T20:55:54.344+00:00
Reading Time: 2 minutes
Summary: [CMP v1] Learn how to switch your Secure Privacy cookie consent banner from Simple to Detailed — giving website visitors full transparency into cookie categories in two easy steps.
The detailed cookie banner in Secure Privacy gives your website visitors full transparency into the cookies and services active on your site — displaying cookie categories and descriptions in an expanded view rather than a simple accept/decline prompt. Enabling it takes just two steps.
Who Is This For?
- Website owners enabling the detailed cookie banner for greater visitor transparency
- Compliance teams switching from a simple to an advanced cookie consent banner to meet GDPR granularity requirements
- Developers and administrators configuring cookie banner type settings in Secure Privacy
How to Enable the Detailed Cookie Banner
Step 1: Navigate to Cookie Banner Settings
Log in to your Secure Privacy account. In the left sidebar, select GDPR (or the applicable compliance module), click the Cookie Banner tab, then click the Settings sub-tab.
Step 2: Switch the Banner Type from Simple to Detailed
The default cookie banner type is set to Simple. Click the Detailed option to switch to the advanced banner view, then click Save to apply the change.
The detailed cookie banner is now enabled. Visitors to your website will see the expanded banner with full cookie category descriptions, as shown below:
Frequently Asked Questions
What is the difference between the Simple and Detailed cookie banner?
The Simple banner displays a basic consent prompt with accept and decline options. The Detailed banner expands this to show individual cookie categories — such as Essential, Analytics, and Marketing — with descriptions of each category's purpose, giving visitors granular control over their consent choices. The Detailed banner supports stronger GDPR compliance by providing greater transparency at the point of consent.
Can I switch back to the Simple banner after enabling Detailed?
Yes. Return to GDPR > Cookie Banner > Settings and switch the banner type back to Simple, then save. The change takes effect immediately.
Does enabling the Detailed banner affect my compliance score?
Switching to the Detailed banner improves transparency — which is a positive signal for GDPR compliance. It gives visitors more granular consent options, which aligns with the GDPR principle that consent should be specific and informed.
See Also
- How to Change the CSS of Your Cookie Consent Banner
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
---
# Secure Privacy Privacy Policy and Cookie Declaration Shortcode Reference Guide
URL: https://support.secureprivacy.ai/article/cmp-v1-short-codes-list
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T21:22:12.012+00:00
Reading Time: 2 minutes
Summary: [CMP v1] Complete reference guide for all Secure Privacy privacy policy and cookie declaration shortcodes — including plugin, cookie category, CCPA, GDPR, and consent status template variables.
This reference article lists all available shortcodes used by Secure Privacy's Privacy Policy and Cookie Declaration templates. These shortcodes are automatically populated with data from your account settings and latest scan results when your policy is generated. Use this reference to understand what each shortcode outputs and where it appears in your policy.
Who Is This For?
- Privacy officers and compliance teams customizing their Secure Privacy privacy policy template
- Developers editing or extending the generated privacy policy and cookie declaration content
- Website administrators understanding what data each shortcode pulls into their published policy
Privacy Policy Shortcodes
The following shortcodes are used within the Privacy Policy template. Each is automatically populated based on your account configuration and scan results.
Privacy policy overview
[sp-website-or-app-name]
Collecting and processing your personal information
[sp-entity-type-para]
What categories of personal information we collect
[sp-personal-info-collected]
Why we collect personal information
[sp-why-we-collect-personal-info]
How we collect your personal data
[sp-gdpr-trust-badge]
Analytics plugins
[sp-wizard-analytics-plugins]
Social media plugins
[sp-wizard-social-media-plugins]
Advertisement plugins
[sp-wizard-advertisement-plugins]
Other plugins and cookies
[sp-wizard-essential-plugins]
[sp-wizard-preference-plugins]
[sp-wizard-customer-interaction-plugins]
[sp-unclassified-plugins]
[sp-av-plugins]
[sp-comments-plugins]
Payments
[sp-wizard-payments-plugins]
How visitors can exercise their rights as owners of personal information
[sp-supported-compliances]
[sp-how-to-excerise-personal-info]
CCPA
[sp-ccpa-trust-badge]
[sp-personal-data-sold-to]
[sp-personal-data-disclosed-to]
Location and transfer of personal information
[sp-plugins-used]
[sp-backup-time]
Security of personal information
[sp-technical-safeguards]
Protecting children's privacy
[sp-children-age]
Contact us
[sp-data-privacy-officer]
[sp-contact-information]
Cookie Declaration Shortcodes
The following shortcodes are used within the Cookie Declaration template. Cookie and service data is populated automatically from your latest scan results.
Cookie declaration overview
[sp-cookie-categories]
Essential cookies
[sp-essential-cookies]
Analytics cookies
[sp-analytics-cookies]
Customer interaction cookies
[sp-customer-interaction-cookies]
Social media cookies
[sp-social-media-cookies]
Advertising cookies
[sp-privacy-policy-link]
[list-of-advertising-cookies]
Preferences cookies
[sp-preferences-cookies]
Other cookies
[sp-comments-cookies]
[sp-av-cookies]
[sp-unclassified-cookies]
Consent status
[sp-domain-name]
[sp-consent-status]
[sp-gdpr-trust-badge]
Changes to this cookie declaration
[sp-entity-type-head]
[sp-date]
Frequently Asked Questions
What populates the shortcodes in the privacy policy?
Shortcodes are populated from two sources: your account settings — such as entity type, contact information, and DPO details — and your latest website scan results, which provide cookie, plugin, and service data. Triggering a rescan updates scan-dependent shortcodes automatically.
Can I add or remove shortcodes from the template?
The shortcodes listed here are part of the pre-built Secure Privacy privacy policy and cookie declaration templates. You can add custom text sections around them using the Preview and edit section in your dashboard, but the system-generated shortcode content cannot be manually edited.
What should I do if a shortcode is showing placeholder text instead of real data?
Placeholder text in a shortcode usually means the relevant account setting has not been completed or a rescan has not been run since the required data was added. Check your account settings for completeness and trigger a new website scan to refresh cookie and plugin data.
See Also
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# How to Change Your Domain Environment in Secure Privacy – Move from Dev or Staging to Production Without Extra Licenses
URL: https://support.secureprivacy.ai/article/cmp-v1-how-to-add-a-development-staging-or-test-domain-to-secure-privacy
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T21:39:05.613+00:00
Reading Time: 2 minutes
Summary: [CMP v1] Learn how to switch your Secure Privacy domain between development, staging, and production environments without buying additional licenses — edit the domain URL and rescan in a few steps.
You do not need to purchase additional licenses to use Secure Privacy across development, staging, and production environments. By editing your domain name in the dashboard, you can move the same configuration — including your API key and all settings — between environments without any extra cost.
Who Is This For?
- Developers testing Secure Privacy on a staging or development environment before going live
- Website administrators switching a configured Secure Privacy domain from a dev or QA URL to production
- Compliance teams managing Secure Privacy across multiple domain environments without buying additional licenses
How to Change Your Domain Environment in Secure Privacy
- Log in to your Secure Privacy account. In the upper-left corner, click All Domains.
- Find the domain you want to edit and click the Edit domain button in that row.
- A modal window will appear allowing you to change the domain URL.
- Enter your staging, testing, or development server URL — for example, dev.mydomain.com — and click Save.
You can now use Secure Privacy on the new domain with the same API key and installation configuration.
Note: After changing the domain URL, trigger a website rescan from the Report section to update the detected cookies and services to those on your staging or development environment — particularly if you have been adding or removing scripts there.
Once you have finished testing, edit the domain URL back from dev.mydomain.com to your production URL — for example, mydomain.com — to go live with your configured settings. Run another rescan after switching to production if your environments differ in any tracked services or scripts.
Frequently Asked Questions
Do I need a separate Secure Privacy license for my staging environment?
No. You can use the same license and API key across your development, staging, and production environments by simply editing the domain URL in the dashboard. Only one URL can be active per domain slot at a time.
Will my configuration be lost when I change the domain URL?
No. All your Secure Privacy settings — including banner configuration, classification, blocking rules, and language settings — are tied to the domain record, not the URL itself. Editing the domain URL retains all existing configuration.
Why should I rescan after changing the domain URL?
Your staging and production environments may have different cookies and third-party services active. A rescan after switching URLs ensures your scan report, blocking configuration, and cookie declaration accurately reflect what is running on the current environment rather than the previous one.
See Also
- Secure Privacy Pricing Plans Overview
- Website Visits vs Page Views vs Consent Explained
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
---
# User Management in Secure Privacy – Add Team Members, Assign Roles, and Manage Domain Access (Enterprise)
URL: https://support.secureprivacy.ai/article/cmp-v1-user-management
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T21:54:18.821+00:00
Reading Time: 3 minutes
Summary: [CMP v1] Learn how to manage users in Secure Privacy Enterprise — add team members, assign Account Owner, Admin, or Domain Admin roles, update domain access, and delete users.
Secure Privacy's user management feature lets account owners add team members, assign role-based access levels, manage domain administrator assignments, and remove users — all from the Users page in your dashboard.
Note: User management is available on the Enterprise plan only. See current plans and billing options on the Secure Privacy pricing page.
Who Is This For?
- Account owners managing team member access across multiple domains in Secure Privacy
- IT administrators assigning and updating user roles for compliance teams
- Enterprise organizations managing granular domain-level access for different team members
User Roles and Access Levels
Secure Privacy provides three user roles, each with a different level of access:
Role
Access Level
Restrictions
Account Owner
Full access to all domain configuration, account details, and billing data
None
Account Admin
Full access to all features across all domains
Cannot change billing or account details
Domain Admin
Full access to assigned domains only
Billing and account details restricted; access limited to specified domains
How to Add a Team Member
- Log in to your Secure Privacy account and click All Domains in the top bar.
- Select Users in the left sidebar to view the list of active users on your account.
- Click the green Add User button to open the add user modal.
- Enter the User Email for the team member. A new Secure Privacy account will be created for this email and associated with your main account — a password reset link will be sent automatically.
- Select the Access level (user role) for this team member.
- Click Save to confirm.
How to Change a Team Member's User Role
- Log in to your Secure Privacy account and click All Domains in the top bar.
- Select Users in the left sidebar.
- Click the Edit link in the Role column next to the relevant user's email to open the edit modal.
- Use the Access dropdown to select the new role for this user.
- For Domain Admin users, you may also select which specific domains they should have access to.
- Click Save to confirm the changes.
How to Change the Administrator of a Domain
Note: Account Owner and Account Admin roles have access to all domains by default — the steps below apply only to Domain Admin users, where domain access must be explicitly assigned.
- Log in to your Secure Privacy account and click All Domains in the top bar.
- Select Users in the left sidebar.
- Click the Edit link in the Website Access column for the relevant Domain Admin user.
- Click Add Domain to assign a domain to this user.
- Select the domain from the dropdown menu.
- Click Save to confirm.
- To remove a domain from this user's access, click the red cross next to the domain name.
How to Delete a User
Note: Users with the Account Owner or Account Admin role cannot be deleted directly. Downgrade their access level to Domain Admin first, then follow the steps below to remove them.
- Log in to your Secure Privacy account and click All Domains in the top bar.
- Select Users in the left sidebar.
- Click the red cross icon next to the user's email address to initiate deletion.
- Click OK in the confirmation popup to complete the deletion.
Frequently Asked Questions
Can I delete an Account Owner or Account Admin directly?
No. Account Owner and Account Admin roles are protected from direct deletion. To remove one of these users, first downgrade their role to Domain Admin using the Edit Role process, then delete them using the red cross icon on the Users page.
Can a Domain Admin manage multiple domains?
Yes. When editing a Domain Admin user's Website Access, you can assign multiple domains to them using the Add Domain button — repeating the selection for each domain they should administer.
What happens when I add a new team member — do they receive a notification?
Yes. When you add a new team member by email, Secure Privacy creates a new account for that email address and automatically sends a password reset link to allow them to set their credentials and log in.
See Also
- Secure Privacy Pricing Plans Overview
- Cross-Domain Consent Setup – Secure Privacy Enterprise
- Website Visits vs Page Views vs Consent Explained
---
# How to Install Secure Privacy on Weebly – Add Cookie Consent Script via Header Code
URL: https://support.secureprivacy.ai/article/cmp-v1-installing-secure-privacy-legacy-on-weebly
Product: Consent Management
Category: Secure Privacy Legacy
Published: 2026-03-06T12:44:00+00:00
Updated: 2026-03-22T21:56:55.405+00:00
Reading Time: 2 minutes
Summary: [CMP v1] Learn how to install the Secure Privacy cookie consent script on your Weebly website — add the script to your Header Code in Weebly's SEO settings in a few simple steps.
This guide explains how to install the Secure Privacy script on a Weebly website — adding it to the Header Code section via Weebly's SEO settings so the cookie consent banner loads on every page of your site.
Who Is This For?
- Weebly website owners installing Secure Privacy's cookie consent banner on their site
- Compliance teams adding GDPR or CCPA cookie consent functionality to a Weebly-hosted website
- Web administrators completing the Secure Privacy setup checklist for a Weebly domain
How to Install Secure Privacy on Weebly
- Log in to your Secure Privacy account and navigate to the Installation page for your target domain.
- Copy the Secure Privacy installation script (including the closing tags.
- Log in to your Weebly Admin Dashboard.
Open Weebly and navigate to the dashboard for the site you want to make GDPR-compliant.
- Open Settings.
From the top navigation bar, click Settings.
- Navigate to SEO.
In the left panel, click SEO to open the site-wide code injection options.
- Paste the Secure Privacy script into the Header Code field.
Locate the Header Code text area and paste the full Secure Privacy script there. Important: do not delete or overwrite any code that is already present in this field — paste below any existing content.
- Click Save.
Click the Save button to apply your changes.
- Publish your site.
Click Publish to push the changes live. Your Secure Privacy cookie consent banner will now appear on your Weebly website.
What Happens After Installation?
Once published, Secure Privacy automatically scans your site for cookies and trackers, categorises them, and presents visitors with a consent banner that matches your configured regulations (GDPR, CCPA, and others). Consent records are stored securely in your Secure Privacy dashboard, giving you an auditable log of compliance — something a basic free banner cannot provide.
You can return to your Secure Privacy dashboard at any time to customise the banner's appearance, adjust the consent categories, update your cookie policy, or switch between regulation modes — without touching your Weebly site again.
Troubleshooting
The cookie banner is not appearing after I publish
First, clear your browser cache and reload the page in a private/incognito window — your own browser may have cached a previous version of the site. If the banner still does not appear, return to Settings → SEO → Header Code in Weebly and confirm the full script is present, including both the opening tags.
I can see the script in Header Code but the banner doesn't show on all pages
Code added via Weebly's Header Code field is injected site-wide by default. If certain pages appear unaffected, ensure the page is published (not just saved as a draft) and that no page-level custom code is overriding the header.
I accidentally removed code that was already in the Header Code field
Check your browser history or Weebly's revision history to recover any overwritten code. Going forward, always paste the Secure Privacy script below any existing content in the Header Code area, never replacing it.
Frequently Asked Questions
Do I need a cookie consent banner on my Weebly website?
Yes — if your Weebly site has visitors from the EU, UK, California, or other regulated jurisdictions, privacy laws such as GDPR and CCPA require you to obtain informed consent before setting non-essential cookies or tracking technologies.
Does Weebly have a built-in GDPR cookie consent tool?
No. Weebly does not include a native, fully compliant cookie consent solution. A dedicated tool like Secure Privacy is needed to handle consent collection, logging, and automatic cookie discovery.
How do I add a cookie banner to Weebly?
Paste your Secure Privacy script tag into the Header Code field found under Settings → SEO in your Weebly Admin Dashboard, then save and publish. The banner will appear on your site immediately.
Will the Secure Privacy script slow down my Weebly site?
No. The Secure Privacy script is lightweight and loads asynchronously, so it does not block page rendering or negatively affect your site's performance.
Can I install Secure Privacy on Weebly without any coding knowledge?
Yes. The entire process involves copying a script from your Secure Privacy dashboard and pasting it into a text field in Weebly's settings. No coding or technical expertise is required.
Where do I find the Secure Privacy installation script?
Log in to your Secure Privacy account, select your domain, and navigate to the Installation page. Your unique script tag is displayed there, ready to copy.
Related Installation Guides
- How to Install Secure Privacy on WordPress
- How to Install Secure Privacy on Shopify
- How to Install Secure Privacy on Wix
- How to Install Secure Privacy on Squarespace
- How to Set Up Your Cookie Policy with Secure Privacy
---
# How to Comply with Google's EU User Consent Policy Using Secure Privacy – Banner Setup and GDPR Requirements
URL: https://support.secureprivacy.ai/article/installing-cookie-banner-compliant-with-googles-eu-user-consent-policy
Product: Consent Management
Category: Google Consent Mode
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-23T21:12:25.294+00:00
Reading Time: 4 minutes
Summary: Learn how to meet Google's EU User Consent Policy requirements using Secure Privacy — enable the Google-compliant consent banner in Templates and Domain Settings in three steps.
Google's EU User Consent Policy requires websites using Google advertising and analytics products to obtain explicit user consent for cookies, local storage, and ad personalization — in compliance with GDPR and ePrivacy regulations across the European Economic Area (EEA) and the UK. This guide explains the policy requirements and how to enable a Google EU UCP-compliant consent banner in Secure Privacy.
Who Is This For?
- Website owners using Google AdSense, AdManager, or AdMob who must comply with Google's EU User Consent Policy
- Compliance officers ensuring GDPR and ePrivacy consent requirements are met for Google advertising products
- Developers and administrators configuring the Google-compliant consent banner in Secure Privacy
Google's EU User Consent Policy — Key Requirements
- Explicit user consent: Consent is required before setting cookies, accessing local storage, or enabling ad personalization.
- Third-party disclosure: Websites must clearly inform visitors about third parties — including Google — that access their data.
- Transparency: Clear information must be provided about how personal data is processed and for what purposes.
Steps to Maintain Compliance with Google's EU Policy
If you use Google AdManager, AdSense, or AdMob, follow these steps to ensure compliance:
Review your consent implementation
Audit your website or app to confirm that your user consent mechanisms, consent banner wording, and data disclosures align with Google's EU User Consent Policy requirements.
Implement a robust consent mechanism
Ensure visitors can easily provide, manage, and withdraw their consent for data collection and advertising personalization — with granular options for each consent category.
Update your privacy notices
Transparently list all data recipients and processing purposes in your privacy policy — including Google services and any other third parties receiving visitor data.
Monitor and audit continuously
Regularly review your consent processes and third-party integrations to identify and close compliance gaps as your technology stack evolves.
How to Enable the Google EU UCP Compliant Banner in Secure Privacy
-
Log in to your Secure Privacy account and navigate to the Templates tab at cmp.secureprivacy.ai/templates. Find the Google template and enable it.
-
Navigate to your domain's Domain Settings and confirm the Google template is enabled for the target domain.
- Click Save to apply the changes. The selected domain will now display the Google EU UCP compliant consent banner.
Banner Requirements Built into Secure Privacy
The Google EU UCP compliant banner in Secure Privacy already includes the following requirements out of the box:
- Fully configurable through a user-friendly interface — no custom code required
- Explains data collection for ad personalization and measurement in visitor-facing language
- Links to Google's privacy and data processing information
- Includes an affirmative consent option — consent signals match the visitor's choice (granted or denied) and are correctly passed to Google via Consent Mode
Enforcement
Websites not complying with Google's EU User Consent Policy may face restrictions on advertising features — including limited access to remarketing, conversion tracking, and ad personalization. To restore full functionality, implement a compliant consent notice and configure your consent mode signals accordingly.
Additional Resources
- Google's EU User Consent Policy Help Page — comprehensive overview, FAQs, and implementation guidance from Google
- Legal consultation: Engage with a qualified legal professional to ensure your implementation meets GDPR and ePrivacy obligations specific to your organization
Common Issues and Fixes
Visitors are not seeing the cookie consent banner
Verify that the Google template is enabled in both the Templates tab and your Domain Settings. Also confirm that the Secure Privacy script is correctly installed and loading on all pages of your website, and that the banner targeting is not restricting display to a region that excludes your test location.
Privacy notices have insufficient disclosure
Update your privacy policy and cookie declaration to fully disclose all data recipients — including Google Ads, Google Analytics, and any other third-party services — along with the purposes for which their data is processed. Secure Privacy's auto-generated cookie declaration pulls this information from scan results.
Consent is not being properly recorded or passed to Google
Check your Consent Mode configuration in the Secure Privacy dashboard to ensure consent signals are correctly mapped and being pushed to the dataLayer. Verify the integration with Google Tag Manager or your gtag.js implementation is receiving and applying the consent status before any Google tags fire.
Need Assistance?
Contact Secure Privacy support at support@secureprivacy.ai for general questions. For urgent Google Consent Mode escalations, contact Andrew Sidorkin directly — the team aims to respond within one business day.
For policy questions directed to Google, contact the Google EU User Consent Policy team at ddp-gdpr-escalations@google.com.
See Also
- Implementing Google Consent Mode Advanced Using GTM
- How to Add a Custom Service or Cookie
- Should You Block All Cookies? GDPR Cookie Categories Explained
- Ensuring Prior Consent for Non-Essential Cookies
---
# IAB Transparency and Consent Framework (TCF) Explained – GDPR Compliance Risks and Secure Privacy's Alternative Approach
URL: https://support.secureprivacy.ai/article/-iab-tcf-explained--google-consent-mode-integration--secure-privacy
Product: Consent Management
Category: Policies & User Consent
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-24T00:55:07.785+00:00
Reading Time: 5 minutes
Summary: Learn what the IAB Transparency and Consent Framework (TCF) is, its GDPR compliance risks, and how Secure Privacy's Google Consent Mode Advanced offers a user-centric alternative for cookie consent management.
The IAB Transparency and Consent Framework (TCF) is the advertising industry's standardized method for managing user consent across publishers, advertisers, and Consent Management Platforms under GDPR. This guide explains how IAB TCF works, its key requirements, the compliance concerns raised by Data Protection Authorities, and how Secure Privacy's approach — using Google Consent Mode Advanced — offers a more user-centric alternative for GDPR-compliant consent management.
Who Is This For?
- Website owners and publishers evaluating whether to implement IAB TCF or an alternative consent management approach
- Compliance officers assessing the GDPR compliance risks associated with IAB TCF
- Ad tech and marketing teams managing consent signals for advertising and analytics vendors
What Is the IAB Transparency and Consent Framework (TCF)?
The IAB TCF sets a standardized method for cooperation between online publishers, advertisers, and Consent Management Platforms (CMPs) to meet GDPR transparency and consent requirements. It enables consent signals to be shared between first parties, third parties, and CMPs — so that each vendor in the ad tech ecosystem receives the correct consent status for each user.
Key Players in the IAB TCF Ecosystem
- Publishers: Website owners who display advertising and collect user data for analytics and personalization.
- Vendors: Third parties — such as advertisers, ad networks, and analytics providers — that process user data under publisher consent.
- CMPs: Services like Secure Privacy that help publishers collect, record, and signal user consent in compliance with the IAB TCF standard.
Note: Several Data Protection Authorities (DPAs) have raised formal concerns about whether IAB TCF fully complies with GDPR — including enforcement actions and legal proceedings against IAB Europe directly.
Key Considerations and Compliance Risks of IAB TCF
- Limited user control: The framework's vendor-centric design may limit website owners' direct control over what user data is collected and by whom — with consent decisions delegated to a vendor-managed list.
- Transparency and UX trade-offs: IAB TCF's strict UI requirements often result in large, text-heavy cookie banners that can overwhelm visitors and reduce consent quality.
- Compliance uncertainties: Multiple DPAs have challenged IAB TCF's GDPR adherence:
- Belgian DPA fines IAB Europe €250,000 for GDPR violations
- Legal proceedings concerning IAB Europe and GDPR compliance — Court of Justice of the EU
IAB TCF Banner and Preference Center Requirements
IAB TCF mandates specific UI and functionality for cookie banners to ensure uniform consent collection across all publishers using the framework. Required elements include:
- A prominent, separately displayed consent banner
- Clear explanation of data storage and processing purposes
- Information about all third-party vendors and their standard processing purposes
- A link to the full IAB vendor list
These requirements make TCF-compliant banners substantially larger and more text-heavy than standard cookie consent banners. Modifications to the banner design may risk non-compliance with TCF certification requirements.
The preference center — accessible via the banner's Customize button — includes two tabs:
- Ad Settings: Visitors can control consent for individual listed vendors and specific processing purposes.
- Settings: Secure Privacy's standard multi-category cookie consent controls — covering Essential, Analytics, Marketing, and other categories.
Secure Privacy's User-Centric Approach to GDPR Compliance
Secure Privacy offers a GDPR-compliant consent management approach that does not depend on IAB TCF — prioritizing user clarity, website owner control, and adaptability to evolving regulations:
- Full control for website owners: Direct management of cookie deployment and consent options — without delegating control to a vendor-managed framework.
- Streamlined consent UX: Intuitive, concise cookie banners that maintain transparency without overwhelming visitors with vendor lists and processing purpose text.
- Google Consent Mode Advanced integration: Future-proof GDPR compliance and conversion measurement capability — independent of IAB TCF certification.
- Adaptable to changing regulations: Secure Privacy's framework updates as privacy laws evolve — covering GDPR, CCPA, LGPD, and 50+ other regulations.
Conclusion: IAB TCF vs. Secure Privacy's Approach
IAB TCF provides a standardized framework for the ad tech ecosystem — but its vendor-centric design, complex UI requirements, and unresolved GDPR compliance questions present real risks for publishers. Secure Privacy's approach — using Google Consent Mode Advanced rather than IAB TCF — prioritizes user privacy, website owner control, and robust GDPR compliance without the compliance uncertainties associated with the IAB framework.
Frequently Asked Questions
Why are IAB TCF cookie banners so large and text-heavy?
IAB TCF mandates that all certified CMPs display specific information about vendors, processing purposes, and user rights — and these requirements are strictly enforced. The resulting banners are necessarily more complex than standard GDPR consent banners. If the verbose banner design is affecting your user experience and conversion rates, Secure Privacy's streamlined consent approach — using Google Consent Mode instead of IAB TCF — provides a cleaner, more user-friendly alternative without sacrificing compliance.
Does IAB TCF guarantee GDPR compliance?
Not unconditionally. While IAB TCF is designed to facilitate GDPR compliance, multiple supervisory authorities — including the Belgian DPA — have found that the framework itself violates GDPR in specific respects. Organizations using IAB TCF should stay current with DPA guidance and enforcement decisions, and consider whether their specific implementation meets GDPR requirements beyond TCF certification alone.
Can I use Secure Privacy without implementing IAB TCF?
Yes. Secure Privacy supports both IAB TCF and non-TCF consent management approaches. For publishers who do not need TCF for advertising purposes, Secure Privacy's Google Consent Mode Advanced integration provides a fully compliant, simpler alternative — without the UI complexity or compliance risks associated with TCF.
See Also
- Secure Privacy: Google-Certified Consent Management Platform
- Basic vs. Advanced Google Consent Mode: Full Comparison
- Global Privacy Platform (GPP) Setup in Secure Privacy
---
# What Is GDPR? A Simple Guide to GDPR Compliance
URL: https://support.secureprivacy.ai/article/what-is-gdpr
Product: Consent Management
Category: Compliance & Regulations
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-26T21:33:03.701+00:00
Reading Time: 2 minutes
Summary: Learn what GDPR is, who it applies to, what personal data means, and how to improve GDPR compliance for your website and business.
The General Data Protection Regulation (GDPR) is the European Union’s data privacy law that governs how organizations collect, use, store, and share the personal data of people in the EU. If your business runs a website, uses cookies, or processes customer data, understanding GDPR is essential for compliance.
This page gives you a quick overview of GDPR and links to the most important topics, including who GDPR applies to, what counts as personal data, GDPR penalties, international data transfers, data breaches, and how to make your website GDPR compliant.
What Is GDPR?
GDPR is a privacy and data protection regulation created by the European Union. It sets rules for how organizations handle personal data and gives individuals more control over their information. GDPR can apply even if your business is not based in the EU, as long as you offer goods or services to EU residents or monitor their behavior online.
Why GDPR Matters for Websites and Businesses
GDPR affects how businesses manage website tracking, cookie consent, privacy notices, user rights, and data security. It is especially important for companies that collect leads, run analytics, use advertising cookies, or process customer information through forms, accounts, or online services.
- It helps protect user privacy and personal data
- It requires transparency about data collection and use
- It can affect cookie banners, consent records, and privacy policies
- Non-compliance can lead to complaints, investigations, and fines
Key GDPR Topics
Use the resources below to explore the most common GDPR questions and compliance issues:
- Why GDPR matters
- Who GDPR applies to
- GDPR penalties and fines
- What personal data means under GDPR
- Transferring data outside the EU
- Who enforces GDPR
- Do you need a Data Protection Officer (DPO)?
- Does GDPR apply to small and medium-sized businesses?
- What to do in case of a data breach
- How to make your organization GDPR compliant
Common GDPR Questions
Who does GDPR apply to?
GDPR can apply to organizations inside and outside the EU if they process the personal data of EU residents in certain situations.
What counts as personal data?
Personal data can include names, email addresses, IP addresses, location data, cookie identifiers, and other information that can identify a person directly or indirectly.
What are the penalties for GDPR non-compliance?
Penalties vary depending on the nature and severity of the violation, but GDPR is known for significant potential fines and strict enforcement expectations.
How can I make my website GDPR compliant?
Common steps include reviewing your data collection practices, using a compliant cookie consent banner, updating your privacy policy, managing user consent correctly, and keeping records of consent where required.
Learn More About GDPR Compliance
For a more detailed explanation of GDPR requirements and practical steps for website compliance, read our full GDPR compliance guide.
---
# Secure Privacy Pricing Plans: Compare Consent Management Features and Choose the Right Plan
URL: https://support.secureprivacy.ai/article/secure-privacy-pricing-plans--consent-management-platform
Product: Consent Management
Category: Subscriptions & Partnerships
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-22T00:18:36.809+00:00
Reading Time: 3 minutes
Summary: Compare Secure Privacy pricing plans, consent limits, and features to choose the right consent management plan for GDPR and privacy compliance.
Choosing the right consent management plan is important for GDPR, CCPA, and ePrivacy compliance. Secure Privacy offers flexible pricing plans for businesses of different sizes, from small websites that need a basic cookie banner to enterprise teams managing millions of monthly consents.
This guide compares the Secure Privacy pricing plans, explains what each tier includes, and helps you choose the best plan for your compliance, traffic, and customization needs.
Who Is This Secure Privacy Pricing Guide For?
This guide is useful for:
- Website administrators managing cookie consent and privacy compliance
- Developers implementing a consent management platform (CMP)
- Marketers overseeing consent tracking and data privacy workflows
- Business owners comparing GDPR-compliant privacy solutions
Secure Privacy Pricing Plans Compared
Secure Privacy offers several consent management pricing tiers so businesses can choose the features and scale they need. The plans range from essential compliance tools to enterprise-level functionality with dedicated support and advanced security options.
Free Plan
The Free Plan is designed for small or new websites that need core consent management features.
- Google Consent Mode V2 support
- Global Privacy Control (GPC)
- Up to 500 monthly consents
- Basic cookie banner setup
Small Plan
The Small Plan includes everything in the Free Plan, plus more flexibility for branding and user management.
- Branding and design customization
- Multi-language cookie banner support
- Increased monthly consent limits
- Multiple user accounts
Business Plan
The Business Plan is built for growing companies that need a broader compliance toolkit and more reporting features.
- All Small Plan features
- Cross-domain consent management
- Extensive privacy policy templates
- Privacy Policy generator and DSAR tools
- Advanced consent reporting and analytics
Advanced Plan
The Advanced Plan is intended for enterprise teams that need greater scalability, stronger access control, and dedicated support.
- All Business Plan features
- Service Level Agreement (SLA)
- Enterprise Single Sign-On (SSO)
- Behind-login page scanning
- Unlimited user accounts
- Up to 5 million consents per month
- Dedicated Account Manager
- Audit Logs
How to Choose the Right Consent Management Plan
If you are comparing Secure Privacy plans, focus on the features you need today and the scale you expect in the future.
- Assess your compliance needs: Consider which regulations apply to your business, such as GDPR, CCPA, or LGPD.
- Review your traffic volume: Your monthly consent volume can help determine which plan fits your website best.
- Compare customization options: If you need branded banners, multiple languages, or advanced workflows, a higher-tier plan may be a better fit.
- Plan for growth: Choose a plan that can support future traffic, more domains, and additional team members.
Secure Privacy Pricing and Billing Information
- Pricing is billed monthly per domain.
- Each domain requires its own license at the same subscription level.
- All paid plans include a 30-day free trial so you can test features before committing.
Need a Custom Consent Management Quote?
If your organization needs a custom pricing plan or has privacy compliance requirements beyond the listed tiers, contact the Secure Privacy sales team at sales@secureprivacy.ai to request a custom quote.
Frequently Asked Questions About Secure Privacy Pricing Plans
What happens if I exceed my monthly consent limit?
Contact Secure Privacy support to discuss a plan upgrade or options for handling higher consent volumes.
Can I switch Secure Privacy pricing plans at any time?
Yes. You can upgrade or downgrade your consent management plan at any time from your account.
Are multiple domains covered under one plan?
No. Pricing is per domain, and each domain requires its own license. All domains on an account must be on the same subscription level.
Which Secure Privacy plan is best for enterprise use?
The Advanced Plan is best suited for enterprise organizations that need features such as SSO, audit logs, SLA coverage, dedicated support, and higher monthly consent capacity.
See Also
- How to Add Custom CSS for Improved Design and Branding
- Cross-Domain Consent Feature for Enterprise Users
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
- Setup DSAR Forms in Secure Privacy
- Embed Privacy Policies Easily
- Single Sign-On (SSO) Configuration: Integration with Microsoft Entra ID
---
# How to Embed Privacy Policies on Your Website Using Secure Privacy – Dashboard and Individual Policy Embed Guide
URL: https://support.secureprivacy.ai/article/embed-privacy-policies-easily--secure-privacy
Product: Consent Management
Category: Policies & User Consent
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-24T00:43:07.37+00:00
Reading Time: 3 minutes
Summary: Learn how to embed Secure Privacy privacy policies on your website — use the Policies dashboard to embed all policies at once, or embed individual policies on specific pages with a few steps.
Embedding your privacy policies directly on your website ensures visitors can access compliance information seamlessly — without leaving your site. Secure Privacy provides two straightforward embedding methods: embedding all policies at once from the Policies dashboard, or embedding individual policies on specific pages. This guide explains both options step by step.
Who Is This For?
- Website administrators integrating Secure Privacy privacy policies into their site HTML
- Compliance officers ensuring privacy and cookie policies are publicly accessible and embedded correctly
- Developers implementing policy embeds across single-language or multilingual websites
Two Ways to Embed Your Policies
Method 1: Embed All Policies from the Policies Dashboard
Use this method to embed all your policies in one place — ideal for displaying a consolidated policy page on your website.
- Log in to your Secure Privacy dashboard and navigate to the Policies section.
- Click the Embed button.
- A popup will appear displaying the embed code for all your policies.
- Select a default language for your policies if needed. Visitors will still be able to switch to their preferred language on your site.
- Copy the embed code and paste it into the HTML of your webpage where you want the policies to appear.
Method 2: Embed Individual Policies on Specific Pages
Use this method to display different policies on different pages — for example, embedding only your cookie declaration on your cookie policy page.
- From the Policies dashboard, select the specific policy you want to embed.
- Click Embed in the left sidebar of the policy's settings page.
- Copy the embed code provided.
- Paste the code into your webpage's HTML at the position where you want the policy to display.
- Select a default language if needed — particularly useful for multilingual websites.
Important Note
If your website already links directly to your policy pages hosted on Secure Privacy, embedding is optional — linked policies will automatically integrate within your Preference Center and remain accessible to visitors through the privacy widget without requiring additional embed code.
Frequently Asked Questions
My embedded policy is not displaying on the page — what should I check?
Verify that the embed code has been placed correctly within the section of your webpage HTML — not in the . After confirming placement, clear your browser cache and your website's server or CDN cache, then reload the page in an incognito window to check whether the policy appears.
The language settings are not applying correctly — how do I fix this?
Confirm that you have selected the correct default language in the embed popup before copying the code. Also check the visitor's browser language settings — Secure Privacy displays the policy in the visitor's browser language by default where a matching translation is available. If the wrong language is still showing, re-generate the embed code with the correct default language selected and replace the existing embed code on your page.
Can I embed the same policy on multiple pages?
Yes. Copy the individual policy embed code and paste it into the HTML of as many pages as needed. The same embed code can be reused across multiple pages without any configuration changes.
See Also
- Mastering the Policies Page for Effective Policy Management
- Mastering the Template Policies Page for Effective Policy Management
- The Policies Page: A Deep Dive into Privacy and User Data Collection
- Using Tables in the Secure Privacy Policy Editor
---
# Supported Privacy Laws & Global Compliance Coverage — Consent Management Platform
URL: https://support.secureprivacy.ai/article/template-coverage--gdpr-ccpa-pipeda-amp-50-regulations
Product: Consent Management
Category: Compliance & Regulations
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-24T17:41:16.071+00:00
Reading Time: 5 minutes
Summary: Explore 56+ supported privacy laws including GDPR, CCPA & LGPD. Full coverage across 6 regions, 27 languages, and both opt-in & opt-out consent models for global compliance.
Our privacy compliance platform provides comprehensive coverage for major data protection laws worldwide. Whether you need to manage GDPR cookie consent in Europe, comply with US state privacy laws like CCPA, or meet data protection requirements across Asia-Pacific, the Middle East, or Latin America, this guide outlines every supported regulation, geographic coverage area, and language to help you address your global compliance needs.
Who Is This For?
This guide is intended for website owners, privacy officers, legal teams, and developers who need to understand which data protection laws and consent management features are available on the platform — and how to configure them for their specific jurisdictions.
Key Highlights
- 56 active privacy law templates covering major global data protection regulations
- Geographic coverage spanning Europe, North America, Asia-Pacific, the Middle East, Africa, and Latin America
- 27 languages supported including all major world languages
- Two consent models (opt-in and opt-out) properly categorized by jurisdiction
Supported Data Privacy Laws by Region
Europe
EU GDPR (General Data Protection Regulation)
- Coverage: All 30 EU/EEA countries — Ireland, France, Germany, Spain, Italy, the Netherlands, and others
- Languages: 25 languages supported — English, French, German, Spanish, Italian, Dutch, and all official EU languages
- Consent Type: Opt-in consent required
- Data Retention: 12 months
UK DPA (Data Protection Act 2018)
- Coverage: United Kingdom
- Languages: English
- Features: Full cookie banner, preference center, and contextual consent support
Switzerland FADP (Federal Act on Data Protection)
- Coverage: Switzerland
- Languages: English, French, German, Italian
- Consent Type: Opt-in consent required
Eastern Europe
- North Macedonia ZZLP: English and Macedonian support
- Serbia ZZPL: English and Serbian support
- Belarus LPDP: English and Belarusian support
- Turkiye KVKK: English and Turkish support
- Ukraine Privacy Law: English and Ukrainian support (opt-out consent model)
North America
Canada
- PIPEDA: Covers all Canadian provinces and territories
- Quebec Law 25: Specific coverage for Quebec
- Languages: English and French for both regulations
United States — State Privacy Laws
The platform supports comprehensive cookie consent and privacy compliance coverage across all US states, with dedicated templates for states that have enacted their own data privacy laws:
States with Dedicated Privacy Laws:
- California CCPA (with Spanish support)
- Virginia CDPA
- Colorado CPA
- Connecticut DPA
- Tennessee IPA
- New Jersey CDPB
- Iowa DPA
- Utah CPA
- Indiana CDPA
- Montana CDPA
- Oregon CPA
- Delaware PDPA
- Texas DPSA
- Kentucky CDPA
- New Hampshire CDPA
- Maryland ODPA
- Vermont DPA
- Minnesota CDPA
- Nebraska DPA
All Other US States and Territories:
- A general template covering the remaining 35 US states and territories
- Bilingual support (English and Spanish)
Middle East & Africa
- UAE PDPL: English and Arabic support
- Saudi Arabia DPL: English and Arabic support
- Oman PDPL: English and Arabic support
- Israel PPL: English and Hebrew support
- Egypt DPL: English and Arabic support
- Morocco DPL: English and Arabic support
- South Africa POPIA: English and Afrikaans support
- Kenya DPA: English only
Asia-Pacific
- China PIPL: English and Chinese support
- Japan APPI: English and Japanese support
- South Korea PIPA: English and Korean support
- Thailand PDPA: English and Thai support
- Singapore PDPA: English and Malay support
- Malaysia PDPA: English and Malay support
- Hong Kong PDPO: English and Chinese support
- Philippines DPA: English and Tagalog support
- Vietnam PDPA: English and Vietnamese support
- Australia APP: English only (opt-out consent model)
- New Zealand Privacy Act 2020: English only (opt-out consent model)
- India DPDPA: English and Hindi support
Latin America
- Brazil LGPD: English and Brazilian Portuguese support
- Panama LSPDP: English and Spanish support
- Colombia DPL: English and Spanish support
- Argentina PLDP: English and Spanish support
Platform Features for Privacy Compliance
Standard Features Available Across Most Regulations
- Cookie Banner: Customizable consent banners aligned with local legal requirements
- Widget Support: Embedded privacy widgets for seamless user experience
- Preference Center: User-friendly privacy preference management
- Contextual Consent: Context-aware consent collection at the point of data capture
Consent Models: Opt-In vs. Opt-Out
Opt-in Consent — Required for most international data protection laws, including GDPR, CCPA-equivalent regulations, and most Asian, African, and Latin American privacy laws.
Opt-out Consent — Used primarily for:
- US state privacy laws (except some newer state laws)
- Australia APP
- New Zealand Privacy Act 2020
- Ukraine
Data Retention Periods
- 12 months: Standard retention period for most international privacy laws
- No retention: US state privacy laws (immediate processing / no storage requirement)
Multilingual Support — 27 Languages
The platform supports 27 languages across all supported regions to ensure legally compliant, locally relevant privacy notices:
- European Languages: English, French, German, Spanish, Italian, Dutch, Portuguese, and all official EU languages
- Asian Languages: Chinese, Japanese, Korean, Thai, Vietnamese, Hindi, Malay, Tagalog
- Middle Eastern & African Languages: Arabic, Hebrew, Afrikaans
- Other Languages: Russian, Turkish, Ukrainian, Belarusian, Serbian, Macedonian
Special Considerations
Contextual Consent Limitations
Most privacy templates support contextual consent collection. However, several newer US state privacy laws have contextual consent disabled by default, including: Tennessee, New Jersey, Iowa, Utah, Indiana, Montana, Oregon, Delaware, Texas, Kentucky, New Hampshire, Maryland, Vermont, Minnesota, and Nebraska.
Disabled Templates (Default)
- EU GDPR (with Google disclaimer): Currently disabled by default
- Global Coverage Template: A comprehensive template covering 240+ countries — currently disabled by default
Getting Started with Privacy Compliance
- Identify Your Jurisdiction: Determine which data protection laws apply to your business based on where your users are located.
- Review Language Requirements: Ensure you're providing privacy notices in the appropriate local languages.
- Configure Consent Type: Set up the correct consent model (opt-in vs. opt-out) based on the applicable laws in each region.
- Enable Required Features: Activate cookie banners, preference centers, and other required privacy compliance features.
Frequently Asked Questions
Which privacy laws does the platform support?
The platform currently supports 56 active privacy law templates, including the EU GDPR, UK DPA, CCPA (California), Brazil LGPD, China PIPL, India DPDPA, and many more across Europe, North America, Asia-Pacific, the Middle East, Africa, and Latin America.
Does the platform support both opt-in and opt-out consent?
Yes. The platform handles both consent models. Opt-in consent is used for GDPR and most international regulations; opt-out consent is configured for US state privacy laws, Australia APP, and New Zealand's Privacy Act 2020.
How many languages are supported for privacy notices?
The platform supports 27 languages, covering all major European, Asian, Middle Eastern, and African languages to ensure locally compliant privacy disclosures.
How often are privacy law templates updated?
Templates are regularly updated to reflect the latest changes in privacy legislation and are actively maintained for production use. Subscribe to the changelog for notifications on template updates.
Support & Updates
All privacy compliance templates are regularly updated to reflect changes in data protection legislation and are actively maintained for production use.
Subscribe to changelog.secureprivacy.ai for updates, including privacy law template changes.
For implementation guidance or additional questions, please contact our support team at support@secureprivacy.ai.
---
# Block Adobe Experience Cloud ID Service Cookies for GDPR Compliance
URL: https://support.secureprivacy.ai/article/block-adobe-experience-cloud-id-cookies--gdpr-compliance
Product: Consent Management
Category: Integrations
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-25T00:41:41.325+00:00
Reading Time: 3 minutes
Summary: Stop Adobe Experience Cloud ID Service from setting cookies without consent. Follow our step-by-step guide to enable GDPR-compliant opt-in in Adobe Experience Platform Data Collection.
The Adobe Experience Cloud ID Service sets cookies automatically in user browsers — without waiting for consent. To meet GDPR cookie consent requirements, you must configure the extension to block these cookies until a user explicitly opts in. This guide walks you through exactly how to enable opt-in within Adobe Experience Platform Data Collection (formerly Adobe Launch / Adobe Tags) to ensure GDPR-compliant cookie behavior.
Why You Need to Block Adobe Experience Cloud ID Service Cookies for GDPR
- By default, the Adobe Experience Cloud ID Service places tracking cookies on every visitor's browser — regardless of consent.
- Under GDPR, non-essential cookies must not fire before a user gives explicit, informed consent.
- Enabling the opt-in feature prevents the ID Service from setting cookies until consent is collected by your Consent Management Platform (CMP).
How to Block Adobe Experience Cloud ID Service Cookies (Step-by-Step)
- Open the Adobe Experience Platform Data Collection interface (Adobe Launch / Adobe Tags).
- Select Extensions from the left-hand menu.
- Locate and open the Experience Cloud ID Service extension settings.
- Scroll to the Opt In section and set Enable Opt In? to Yes.
- Save and publish your changes. Cookies will now be blocked until the user provides GDPR-compliant consent.
Setting "Enable Opt In?" to Yes in the Experience Cloud ID Service extension blocks cookies until GDPR consent is given.
Best Practices for GDPR-Compliant Adobe Cookie Blocking
- Confirm that Enable Opt In? is set to Yes and the extension is published to your live environment.
- Test across multiple browsers to verify that Adobe cookies do not fire before consent is granted.
- Integrate this setting with a certified Consent Management Platform (CMP) — such as Secure Privacy — to ensure full GDPR compliance.
- Keep the Experience Cloud ID Service extension updated to the latest version to avoid known consent-handling bugs.
Who Should Use This Guide?
- Website compliance officers responsible for GDPR and ePrivacy readiness.
- Privacy-focused developers configuring Adobe tags and consent flows.
- Digital marketers managing Adobe Experience Cloud services who need to ensure cookie consent compliance.
Frequently Asked Questions (FAQ)
Why are Adobe Experience Cloud cookies still loading after enabling opt-in?
First, clear your browser cache and hard-reload the page. Then confirm you have published the latest library version in Adobe Data Collection. If the issue persists, check that no other tag rules are triggering the ID Service before consent fires.
The opt-in setting is not working on some pages — what should I check?
Review the path exclusions inside the extension configuration. If certain pages are excluded from your tag container, the opt-in logic may not run. Ensure your consent event is firing correctly on those pages.
Does enabling opt-in affect Adobe Analytics or Adobe Target as well?
Yes. When opt-in is enabled at the ID Service level, it can gate downstream Adobe solutions (Analytics, Target, Audience Manager) from setting cookies until consent is received, depending on how your solution integrations are configured.
See Also
- Ensuring Prior Consent for Non-Essential Cookies – GDPR Compliance
- Secure Privacy Now a Google-Certified Consent Management Platform
---
# How to Customize Your Cookie Consent Banner Design in Secure Privacy – Position, Colors, Buttons, and Custom CSS
URL: https://support.secureprivacy.ai/article/enhance-the-look-of-your-website-with-customized-cookie-banners-design
Product: Consent Management
Category: Customization
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-24T00:02:22.803+00:00
Reading Time: 3 minutes
Summary: Learn how to customize the Secure Privacy cookie consent banner — configure banner position (bar, corner, middle), adjust colors, style Accept/Decline buttons, and apply custom CSS.
The Design > Cookie Banner page in Secure Privacy gives you full control over your cookie consent banner's appearance — including position, padding style, custom CSS, colors, and button styling. This guide walks through every available design setting so you can create a banner that matches your brand and provides a clear consent experience for visitors.
Who Is This For?
- Website administrators and designers customizing the Secure Privacy cookie banner appearance
- Developers applying custom CSS or advanced color configuration to the consent banner
- Compliance and UX teams ensuring the cookie banner is visible, accessible, and brand-consistent
How to Access Cookie Banner Design Settings
Log in to your Secure Privacy account and navigate to Design in the dashboard. Select the design you want to modify, then open the Cookie Banner section to access all available customization options.
Banner Position Options
Secure Privacy provides several pre-defined banner position designs — each can be customized further using the color and CSS settings below.
Bar Position
The bar position displays the cookie banner as a horizontal bar across the top or bottom of the viewport. Two bar design variants are available, balancing visibility with a clean, non-intrusive appearance.
Bar with Padding
The bar with padding option adds spacing around all sides of the banner, giving it a floating, elevated appearance that draws attention without covering page content.
Corner Position
The corner position places the banner in a corner of the viewport — unobtrusive and easily spotted. This option integrates naturally into most website layouts without interrupting the main content area.
Middle Position
The middle position places the banner as a centered overlay on the page — highly visible and ideal for designs where consent must be clearly acknowledged before the visitor continues browsing.
Advanced Customization
Custom CSS
For full design control, apply custom CSS to the cookie banner. Custom CSS lets you override or extend default styles — adjusting layout, typography, spacing, animations, or any other visual property to match your website's design system precisely.
Color Settings
Adjust banner colors to match your brand palette. Available color controls include:
- Background color
- Border color
- Text color — headings, body text, links, and hover states
Accept, Decline, and Customize Button Styling
Each consent button — Accept, Decline, and Customize — can be styled independently. Available options include:
- Fill style: Filled background or stroke (outline) only
- Corner style: Smooth, sharp, or rounded corners
- Colors: Background color, hover background color, text color, and hover text color — configured separately for each button
Preview
Before publishing your design, use the preview feature to see how the banner will appear on desktop, tablet, and mobile devices. Switch to full screen for the most accurate visualization. Note that the preview provides an approximate representation and may not be 100% identical to the live banner on all browsers and devices.
Frequently Asked Questions
Can I use a different position for mobile vs. desktop?
The banner position setting applies globally across all devices. To apply device-specific positioning, use custom CSS with media queries to override the default positioning for specific screen sizes.
Will custom CSS override all default banner styles?
By default, custom CSS is applied on top of the existing banner styles — only the properties you specify are overridden. To replace all default styles entirely, enable the Replace Default CSS option in the Custom CSS settings. Use this only if you are supplying a complete custom stylesheet for the banner.
Can I style the Accept and Decline buttons differently from each other?
Yes. The Accept, Decline, and Customize buttons each have their own independent styling controls — including fill style, corner style, background color, hover color, and text color. Configure each button separately to achieve the visual hierarchy you need for your consent UI.
See Also
- How to Add Custom CSS to Your Cookie Consent Banner
- Upload a Custom Logo to Your Banner
- Managing Designs in Secure Privacy
---
# Secure Privacy Laws Report Updates – Improved Data Mapping, Visitor Tracking, Geolocation Detection, and UI Fixes
URL: https://support.secureprivacy.ai/article/laws-report-enhancements
Product: Consent Management
Category: Policies & User Consent
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-24T00:27:29.804+00:00
Reading Time: 2 minutes
Summary: Secure Privacy's Laws Report now features region-based data mapping, expanded visitor tracking, improved geolocation detection, and UI fixes for icons and regional display consistency.
Secure Privacy has introduced a series of improvements to the Laws Report — enhancing data mapping accuracy, expanding visitor tracking coverage, improving geolocation detection, and delivering a more consistent UI across all regions and templates.
Who Is This For?
- Compliance teams using the Laws Report to monitor consent activity and regional visitor data
- Website administrators reviewing regional compliance coverage and report accuracy
- Privacy officers using Secure Privacy reporting to demonstrate regulatory compliance across jurisdictions
What's New in the Laws Report
Refactored data mapping logic
Previously, the Laws Report chart was mapped using template names — which could produce inconsistent or misleading visualizations when templates were renamed or restructured. The updated implementation maps data based on predefined geographic regions, delivering cleaner, more meaningful chart visualizations that accurately reflect where visitor interactions are occurring.
Visitor tracking update
The Laws Report now tracks visitor data rather than consent data alone. This broader tracking scope is supported by improved backend logic — providing more accurate reporting and enabling region-specific insights into both visitor volume and consent behavior across jurisdictions.
Geolocation detection improvements
Region detection has been enhanced to more accurately classify visitors by geographic area. For example, visitors from India are now correctly mapped under the Asia region — ensuring regional reporting is accurate and that compliance coverage gaps are correctly identified in the report.
UI and UX Enhancements
- Fixed icon mapping: Resolved icon mapping issues that affected newly created or recently modified templates — icons now display correctly for all active template configurations.
- Fallback icons for unmapped regions: Added fallback icons for regions without a specific template association, ensuring UI consistency across all report views regardless of regional coverage gaps.
- Improved region-based display handling: Enhanced how region-based data is rendered in the report interface — improving visibility and usability when reviewing multi-region compliance data.
Frequently Asked Questions
Will these changes affect my existing Laws Report data?
The refactored data mapping logic changes how data is visualized — mapping by predefined region rather than template name — but does not alter your underlying consent records. Historical data may appear differently organized in the updated chart view, but no consent records have been modified.
Why does the report now show visitor data instead of only consent data?
Tracking visitor data alongside consent data gives a more complete picture of your compliance posture — showing not just how many consent interactions were recorded, but how many visitors were present in each region and whether they were presented with the appropriate consent banner. This enables more accurate identification of coverage gaps.
What should I do if a region is still displaying incorrectly in my Laws Report?
If you notice incorrect region classification or missing icons after these updates, contact Secure Privacy support at support@secureprivacy.ai with details of the affected region and template configuration.
See Also
- How to Increase Your Compliance Score (Overall Rating)
- Customize Your Cookie Banner Using Templates
- Secure Privacy Pricing Plans Overview
---
# How to Install the Secure Privacy Plugin on Joomla – Cookie Consent Setup Guide
URL: https://support.secureprivacy.ai/article/how-to-install-secure-privacy-on-joomla
Product: Consent Management
Category: Integrations
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-25T00:17:13.467+00:00
Reading Time: 3 minutes
Summary: Step-by-step guide to installing the Secure Privacy cookie consent plugin on Joomla. Configure GDPR compliance, enable the extension, and verify your setup in minutes.
This guide walks you through installing the Secure Privacy plugin on Joomla — a flexible, open-source CMS used to power millions of websites worldwide. Whether you are new to Secure Privacy or adding a new domain to an existing account, this step-by-step tutorial will help you configure the Joomla cookie consent plugin for full GDPR, CCPA, and ePrivacy compliance.
Who Is This Guide For?
- Website administrators managing a Joomla site
- Web developers implementing cookie consent and privacy compliance
- Marketers managing user consent, cookie banners, and tracking settings
Step 1 – Get Your Secure Privacy Script Code
- After activating your Secure Privacy account, you will be prompted to choose an installation method.
- Select Joomla.
- Copy the script code displayed on screen and save it somewhere accessible.
- Keep this tab open and open a new tab to proceed with the Joomla plugin installation.
Step 2 – Install the Secure Privacy Joomla Plugin
- Download the Secure Privacy Joomla Plugin (.zip).
- Log in to your Joomla administrator panel (typically at www.yourjoomlawebsite.com/administrator) and navigate to System.
- Under Install, click Extensions. An upload area will appear.
- Click Browse for file and upload the downloaded .zip plugin file.
- On a successful upload, Joomla will display: Installation of the plugin was successful. Click Manage Extensions.
- Search for Secure Privacy and click the icon in the Status column to enable the extension. A confirmation message will appear.
- Go back to System and click Plugins under Manage.
- Use the search box to find Secure Privacy.
- Click the plugin name to open its configuration. Paste the script code you copied from Secure Privacy into the Installation Script field.
Note: If you are adding a new domain from the Secure Privacy Dashboard, copy the script from the Installation screen of that domain.
- Save your changes. Joomla will confirm with a Plugin saved. message.
Adding a new domain? If you are following this guide while adding a new domain from the Secure Privacy dashboard, return to the Secure Privacy screen after saving and click Test Installation to verify the setup for that domain.
Step 3 – Verify the Installation in Secure Privacy
- Switch back to the Secure Privacy onboarding tab.
- Click Test Installation to verify the Joomla plugin is correctly connected.
- A toast notification at the bottom-left of the screen will confirm a successful Joomla cookie consent plugin installation.
Common Issues & Fixes
Plugin does not appear after installation
Make sure the .zip file uploaded without errors and that Joomla displayed the installation success message. Try re-uploading if needed.
Unable to enable the plugin
Check your user permissions in Joomla and confirm you have full administrator access before attempting to enable extensions.
Installation script is not working
Verify that the exact script code from Secure Privacy was pasted without any modifications or extra spaces, then save the plugin configuration again.
Frequently Asked Questions
Does Joomla support GDPR cookie consent out of the box?
Joomla does not include a built-in GDPR cookie consent solution. The Secure Privacy plugin adds a fully configurable cookie banner and consent management layer to your Joomla site.
Is the Secure Privacy Joomla plugin free?
Secure Privacy offers a free trial. After the trial period, a paid subscription is required to continue using cookie consent and privacy compliance features on your Joomla site.
Can I use this plugin on multiple Joomla domains?
Yes. Each domain requires its own script code generated from the Secure Privacy dashboard. Repeat the installation steps for each additional domain.
Where do I find my Secure Privacy script code?
Your unique script code is shown on the Installation screen inside the Secure Privacy dashboard, either during initial onboarding or when adding a new domain.
See Also
- How to block cookies in complex GTM triggers (consent-based tagging)
- How to install Secure Privacy on WordPress
- Implementing Microsoft UET Consent Mode with Secure Privacy
---
# How to Allowlist the Secure Privacy Scanner IP Addresses – Bypass Bot Protection for Accurate Compliance Scanning
URL: https://support.secureprivacy.ai/article/allowlist-secureprivacyai-scanner-in-firewalls-cdns
Product: Consent Management
Category: FAQs
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-22T22:23:29.752+00:00
Reading Time: 2 minutes
Summary: Learn how to allowlist Secure Privacy's scanner IP addresses in your firewall, CDN, or WAF — ensuring accurate cookie and consent banner scanning without bot protection blocks. Request the current list via support@secureprivacy.ai
Modern bot protection systems — including Cloudflare, AWS WAF, and similar platforms — can challenge or block automated traffic, including legitimate compliance scanners. The Secure Privacy scanner needs reliable, uninterrupted access to your website to detect consent banners, cookies, trackers, and privacy signals accurately. The recommended approach is to create an IP-based allowlist using the scanner IP addresses provided by Secure Privacy.
Who Is This For?
- Website administrators and DevOps teams managing firewall, CDN, or WAF rules that may block automated traffic
- Compliance teams troubleshooting failed or incomplete Secure Privacy scans caused by bot protection challenges
- Security teams configuring allowlist rules for the Secure Privacy scanner IP addresses
How It Works
- What you configure: An allowlist rule in your firewall, CDN, or WAF that permits the Secure Privacy scanner's IP addresses to bypass bot challenges and strict rate limits.
- What Secure Privacy provides: A current list of scanner IP addresses — available on request by emailing support@secureprivacy.ai.
Quick Start: Allow the Secure Privacy Scanner in 3 Steps
-
Request the scanner IP list. Email support@secureprivacy.ai with the subject line "Scanner IP allowlist". Include your domain(s) and environments — for example, production and staging.
-
Create an allow rule. In your firewall, CDN, or WAF, create a rule that allows or bypasses bot protection for the provided scanner source IPs.
-
Verify the scan. Run a scan from your Secure Privacy dashboard — or ask support to trigger one — and confirm that no challenges or blocks occur.
Tip: Place the allowlist rule near the top of your rule set so it takes precedence over generic bot protection and rate-limit policies.
Frequently Asked Questions
Why do I need to allowlist the Secure Privacy scanner?
Bot protection systems cannot distinguish between malicious crawlers and legitimate compliance scanners. Allowlisting the Secure Privacy scanner's IP addresses ensures accurate privacy and compliance scanning without triggering human verification challenges or false blocks that would produce incomplete scan results.
How do I get the current scanner IP addresses?
Email support@secureprivacy.ai with the subject "Scanner IP allowlist". The support team will provide the up-to-date IP list and can notify you of any future changes upon request.
Do the scanner IP addresses change?
Rarely, but yes — the scanner IPs can change. If your scans begin failing or returning incomplete results, re-request the current IP list from support and update your allowlist rule accordingly.
Will allowlisting the scanner IPs weaken my site security?
No. You are only granting access to a specific, known set of IP addresses — not opening your site to general automated traffic. Keep the allowlist rule narrowly scoped to the provided IPs and maintain all existing bot protection and security policies for all other traffic.
Need Help?
Contact the Secure Privacy support team at support@secureprivacy.ai — we are happy to assist with IP requests, rule configuration guidance, or troubleshooting failed scans.
See Also
- Secure Privacy Setup and Installation Checklist
- Secure Privacy Pricing Plans Overview
- How to Increase Your Compliance Score (Overall Rating)
---
# How to Display Your Company Logo in the Secure Privacy Preference Center
URL: https://support.secureprivacy.ai/article/how-to-enable-your-custom-logo-in-the-secure-privacy-preference-center
Product: Consent Management
Category: Customization
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-23T22:34:04+00:00
Reading Time: 2 minutes
Summary: Show your company logo in the Secure Privacy Preference Center. Follow these simple steps to enable the Display Header Logo toggle and create a branded consent experience.
Summary: This guide walks you through how to display your company logo in the Secure Privacy Preference Center, creating a more consistent, on-brand consent experience for your website visitors. The logo shown in the Preference Center is the same one configured under your global Secure Privacy account settings.
Who Is This Guide For?
- Website owners and marketers who want a branded consent Preference Center that reflects their company identity
- Designers and developers configuring the visual appearance of Secure Privacy's CMP for a specific domain
- Compliance managers ensuring the Preference Center presents a trustworthy, professional user interface
How to Display Your Logo in the Secure Privacy Preference Center
-
Log In to Your Secure Privacy CMP Dashboard
Begin by logging in to your Secure Privacy CMP dashboard.
-
Navigate to the Designs Tab
Once logged in, go to the Designs tab in your dashboard navigation.
Navigate to the Designs tab in your Secure Privacy CMP dashboard.
-
Select the Design You Want to Modify
Click on the specific design you wish to update. This is typically the design associated with your domain.
-
Open Preference Center Settings
Within your selected design, navigate to the Preference Center settings section.
-
Enable the "Display Header Logo" Toggle
Locate the toggle labeled "Display Header Logo" and enable it to activate your company logo in the Preference Center header.
Enable the "Display Header Logo" toggle in Preference Center settings to show your brand logo.
📌 Important: Where Does the Logo Come From?
The logo displayed in the Preference Center is the same logo configured under the Settings tab in your overall Secure Privacy account. If you have not yet uploaded a logo, or need to update it, follow the Upload Custom Logo guide before enabling this toggle.
Frequently Asked Questions (FAQ)
Where does the Preference Center logo come from?
The logo displayed in your Preference Center is pulled from the logo you have already uploaded under the Settings tab of your Secure Privacy account. You cannot set a separate logo for the Preference Center alone—it uses your global account logo.
What if I haven't uploaded a logo yet?
You'll need to upload your company logo first via the Upload Custom Logo guide in your Secure Privacy settings before the Display Header Logo toggle will show anything.
Can I show different logos on different domains?
Each design in Secure Privacy is associated with a specific domain. If you have separate designs per domain, the logo displayed will follow whichever logo is set at the account level. Contact support@secureprivacy.ai if you need per-domain logo customization guidance.
Will enabling the logo affect my cookie banner as well?
No. The "Display Header Logo" toggle only applies to the Preference Center. Cookie banner appearance is managed separately within the Cookie Banner section of your design settings.
See Also
- Upload a Custom Logo — Personalize the Appearance of Banners
- Secure Privacy — Google-Certified Consent Management Platform
---
# Secure Privacy Partner Program – Refer, Resell, and Earn with a GDPR Consent Management Platform
URL: https://support.secureprivacy.ai/article/partner-with-secure-privacy-and-elevate-your-business-with-data-privacy-expertise
Product: Consent Management
Category: Subscriptions & Partnerships
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-22T00:23:42.301+00:00
Reading Time: 2 minutes
Summary: Join the Secure Privacy Partner Program to earn commissions or resell GDPR and CCPA compliance tools. Two programs available: Referral and Solution Provider.
The Secure Privacy Partner Program gives agencies, consultants, and technology providers a structured way to earn revenue by reselling or referring a leading GDPR and CCPA consent management platform. Whether you want to refer clients and earn commissions or fully manage privacy compliance on their behalf, there is a program built for your business model.
Why Join the Secure Privacy Partner Program?
- Turn data privacy into a competitive advantage: Differentiate your services by offering clients a trusted, regulation-ready consent management solution.
- Earn commissions and product discounts: Generate recurring revenue through referrals and receive attractive discounts on Secure Privacy's tools.
- Strengthen client trust: Demonstrate your commitment to data privacy by integrating Secure Privacy into your service offering.
Choose the Right Partner Program for Your Business
Referral Program
The simplest way to earn with Secure Privacy. Share your unique affiliate link and earn commissions for every customer who signs up through your referral.
- No sales management required
- Commission earned per successful referral
- Ideal for bloggers, consultants, and marketers
Solution Provider Program
A full reseller and support model for agencies and service providers who manage compliance on behalf of their clients.
- Manage sales, support, and client invoicing directly
- Dedicated account management and sales resources
- Rights to use the Secure Privacy partner logo
- Ideal for digital agencies, IT consultancies, and privacy professionals
Secure Privacy Partner Benefits
- Revenue opportunities: Earn commissions and access discounts on Secure Privacy's consent management solutions.
- Marketing support: Use co-branded marketing materials and resources to promote Secure Privacy to your clients and network.
- Dedicated account management: Get expert assistance from a dedicated partner account manager and sales team.
- Technical expertise: Access Secure Privacy's deep knowledge base on GDPR, CCPA, ePrivacy, and global privacy compliance.
- Brand recognition: Strengthen your reputation by associating with a trusted, globally recognized data privacy platform.
Trusted by Leading Organizations Worldwide
Secure Privacy is trusted by businesses of all sizes — including Fortune 500 companies — to manage cookie consent, safeguard visitor data, and maintain compliance with global privacy regulations. As a partner, you bring that same credibility to your clients.
Frequently Asked Questions
What is the difference between the Referral Program and the Solution Provider Program?
The Referral Program is commission-based — you share a link and earn when someone signs up. The Solution Provider Program is a full reseller model where you manage the client relationship, provide support, and handle invoicing directly.
How do I become a Secure Privacy partner?
You can apply to join the partner program directly through the Secure Privacy partner page. Once approved, you will receive access to your partner portal, affiliate link, and onboarding resources.
Become a Secure Privacy Partner Today
Join a growing network of privacy-focused partners and help your clients achieve GDPR and CCPA compliance. Apply to the Secure Privacy Partner Program and start building a revenue stream around data privacy.
See Also
- Secure Privacy Pricing Plans Overview
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
- Website Visits vs Page Views vs Consent Explained
---
# Website Visits vs Page Views vs Consent Explained – Web Analytics and GDPR Compliance Glossary
URL: https://support.secureprivacy.ai/article/website-visits-vs-page-views-vs-consent-explained
Product: Consent Management
Category: Policies & User Consent
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-24T12:58:52.78+00:00
Reading Time: 4 minutes
Summary: Learn the difference between website visits, page views, and user consent — and why GDPR and CCPA make consent the legal foundation of responsible data collection with Secure Privacy.
Understanding the difference between website visits, page views, and user consent is essential for anyone managing web analytics, marketing measurement, or privacy compliance. This guide explains each concept clearly — and why Secure Privacy treats consent as the foundation of responsible, lawful data collection under GDPR and CCPA.
Who Is This For?
- Website owners and marketers interpreting web analytics and understanding how visits, page views, and consent relate to each other
- Compliance officers explaining the difference between behavioral metrics and legally required consent records
- Developers and analysts configuring consent-aware tracking and understanding what data can be collected at each consent state
What Is a Website Visit?
A website visit — also called a session — begins when a user starts interacting with your website and ends when they leave or remain inactive for approximately 30 minutes. A single visit can include multiple page views, events, and interactions across different pages.
For example: if a user finds your blog through a search engine and clicks the link, their entire time browsing your site counts as one website visit — regardless of how many pages they view during that session.
What Is a Page View?
A page view is recorded each time a user loads or reloads a specific webpage — regardless of whether it is within the same session or a new one. Navigating across multiple pages during a single visit generates multiple page views.
For example: if a visitor reads five blog posts during one session, each page load counts as a separate page view — giving a total of five page views for that one website visit.
What Is User Consent?
Consent refers to a user's explicit agreement to allow data collection, cookie usage, or personal data processing on a website. Unlike visits and page views — which are behavioral metrics — consent is a legal requirement under regulations including GDPR and CCPA.
For example: when a visitor from California accepts a cookie banner asking permission for analytics and advertising data use, they have given valid consent for those specific purposes. Without that consent, data collection must be restricted to essential cookies only.
Why User Consent Is More Important Than Visit or Page View Counts
Website visits and page views provide valuable insight into visitor behavior — but they cannot legitimize data collection on their own. Consent is what makes data collection lawful and ethical. Secure Privacy is built around this principle: ensuring that consent is collected correctly, recorded in a tamper-proof audit log, and respected across all tracking and analytics tools before any non-essential data is gathered.
Summary
Website visits measure how users engage with your site over time. Page views count individual page loads within and across sessions. Consent determines whether you are legally permitted to collect and process the data generated by those visits and page views. Together, understanding these three elements supports both effective marketing measurement and ongoing compliance with GDPR, CCPA, and other applicable privacy laws.
Frequently Asked Questions
Can a page view happen without a website visit?
No. A page view always occurs within the context of a website visit or session. Every page load is part of an active or new session — there is no mechanism by which a page view is recorded outside a session context in standard web analytics.
What happens to data collection if a user does not give consent?
Without consent, data collection must be limited to cookies and processing that is strictly necessary for the website to function — such as session management and security cookies. Non-essential cookies — including analytics, advertising, and social media trackers — must not be set until valid consent is obtained. Collecting non-essential data without consent is a violation of GDPR and CCPA and can result in significant fines. Secure Privacy enforces this automatically through its cookie blocking engine.
How does Secure Privacy record consent alongside visit and page view data?
Secure Privacy records every consent interaction — including accepts, declines, and preference changes — in a secure, timestamped audit log. This consent record is separate from behavioral analytics data and is stored in compliance with GDPR's accountability requirements, providing auditable proof of consent for each visitor interaction.
See Also
- Navigate and Utilize Your Consent Dashboard: An In-depth Guide
- Secure Privacy Volume Discounts | Custom Consent Storage Pricing
- How to Add a Custom Service or Cookie
---
# How to Set Up Contextual Consent in Secure Privacy: Templates, sp-consent Attribute & GDPR Compliance
URL: https://support.secureprivacy.ai/article/formatting-and-utilizing-a-contextual-consent-page-template
Product: Consent Management
Category: Customization
Published: 2026-03-06T12:43:00+00:00
Updated: 2026-03-23T23:10:24.195+00:00
Reading Time: 6 minutes
Summary: Set up contextual consent in Secure Privacy to block iframes and images until users consent. Customize templates, add the sp-consent attribute, and stay GDPR compliant — step-by-step guide.
Summary: Contextual consent gives users a fair, transparent way to understand and agree to the specific use of their personal data before content such as embedded videos, maps, or iframes is loaded. This guide walks through how to set up and customize a Contextual Consent page in Secure Privacy using the Templates feature — including enabling the feature, configuring message and button text, previewing across devices, and implementing the sp-consent attribute on your page.
Who Is This Guide For?
- Website administrators managing GDPR and CCPA-compliant consent flows for embedded content
- Developers implementing the sp-consent attribute on img or iframe elements
- Marketers and compliance managers customizing contextual consent messaging and button text to reflect their brand
What Is Contextual Consent?
Contextual consent is a privacy mechanism that blocks embedded third-party content — such as YouTube videos, Google Maps, or social media iframes — from loading until the user explicitly agrees to the data sharing that content involves. Rather than relying solely on a cookie banner, contextual consent presents a targeted, in-context prompt at the point where the content would appear, giving users a clear and informed choice.
This approach supports compliance with GDPR, CCPA, and other privacy regulations by ensuring personal data is only shared with third parties after active, specific user consent.
How to Access the Contextual Consent Template in Secure Privacy
To locate and configure the Contextual Consent feature:
- Log in to your Secure Privacy account
- Click Templates in the main navigation bar
- Select the template you want to modify
- Switch to the Contextual Consent tab
Navigate to Templates, select your template, and open the Contextual Consent tab in your Secure Privacy dashboard.
Contextual Consent Template Features
Enable Contextual Consent
The Enable Contextual Consent toggle activates the contextual consent functionality for your selected template. Once enabled, interactive consent buttons and overlay widgets will appear to your website users directly over any pixel or iframe service that requires consent before loading.
Preview Your Contextual Consent Page
Secure Privacy's three-way preview simulates how your contextual consent overlay appears across different device types — desktop, tablet, and mobile. Note that the preview is an approximate indicator; for the most accurate representation, switch to full-screen view to see the page exactly as your users will.
Click the EDIT button at any time to switch to editing mode, where you can adjust text, button labels, and settings. This flexibility ensures your contextual consent page always accurately reflects your brand values and privacy commitment.
Use the three-way preview to check your contextual consent overlay across device sizes, then switch to full-screen for the most accurate view.
Language Settings
All Secure Privacy templates are preconfigured and pre-translated, giving users a localized consent experience out of the box. To add or remove a supported language, navigate to Templates > Settings.
Message Settings: Customizing Consent Text
Under Text in the Message Settings panel, you can fully customize the copy displayed on your contextual consent overlay. Write clear, concise, and informative text that explains what data is being shared and why — reinforcing your brand's commitment to data transparency and user privacy.
Button Text: Call-to-Action Labels
Button text controls the labels shown on each consent action button — such as "Accept," "Decline," or "Learn More." These labels should be direct and action-oriented, clearly communicating what each choice means for the user's data. Under GDPR, consent and refusal options must be equally prominent and unambiguous.
Customize your consent overlay message text and button labels in the Message Settings panel.
How to Install Contextual Consent: Adding the sp-consent Attribute
To activate contextual consent blocking on a specific embedded element, add the sp-consent attribute to any or
Example — blocking an image pixel:
Important: The sp-consent attribute is required on every element you want contextual consent to govern. Do not skip this step — without it, the element will load without triggering the consent overlay.
Update Cookie Classification for Contextual Consent Elements
After adding the sp-consent attribute to your tags, ensure that the corresponding img or iframe elements are correctly categorized in your Domain Settings > Classification tab. Proper classification ensures the contextual consent overlay is triggered by the correct consent category (e.g., marketing, functional) as defined in your template.
Categorize your img and iframe elements correctly under Domain Settings > Classification to ensure the right consent overlay is triggered.
Frequently Asked Questions (FAQ)
What is contextual consent and how is it different from a cookie banner?
A cookie banner asks for broad consent when a user first visits your site. Contextual consent works differently — it blocks specific embedded elements (like videos or maps) from loading and displays a targeted consent prompt directly where that content would appear. This gives users granular, in-context control over individual data-sharing events, which is particularly important under GDPR for third-party embeds.
Which HTML elements does the sp-consent attribute work on?
The sp-consent attribute can be added to any or
Important: The sp-consent attribute is required on every element you want contextual consent to govern. Do not skip this step — without it, the element will load without triggering the consent overlay.
Update Cookie Classification for Contextual Consent Elements
After adding the sp-consent attribute to your tags, ensure that the corresponding img or iframe elements are correctly categorized in your Domain Settings > Classification tab. Proper classification ensures the contextual consent overlay is triggered by the correct consent category (e.g., marketing, functional) as defined in your template.
Categorize your img and iframe elements correctly under Domain Settings > Classification to ensure the right consent overlay is triggered.
Frequently Asked Questions (FAQ)
What is contextual consent and how is it different from a cookie banner?
A cookie banner asks for broad consent when a user first visits your site. Contextual consent works differently — it blocks specific embedded elements (like videos or maps) from loading and displays a targeted consent prompt directly where that content would appear. This gives users granular, in-context control over individual data-sharing events, which is particularly important under GDPR for third-party embeds.
Which HTML elements does the sp-consent attribute work on?
The sp-consent attribute can be added to any