Privacy management is software that runs a company's privacy programme. It records each person's consent, handles their requests to see or delete their personal data, and keeps a map of where personal data is stored and sent. It is also called a privacy management platform.
Privacy law gives people rights over their personal data, and gives companies duties. India's Digital Personal Data Protection Act, 2023, or DPDP Act, calls the person a data principal and the company a data fiduciary. The page on data protection law explains the law itself. Privacy management is the software that lets a company carry out those duties every day, for lakhs of customers.
Consider an online fashion store in Jaipur with 9 lakh customers. When a new shopper signs up, the website shows a consent notice. It asks for consent separately for each purpose: order updates by SMS, offers by email, and recommendations based on what she browses. She agrees to the first and the third, and refuses the second. The privacy software stores her choice, with the time and the version of the notice she saw. It then passes the choice to the customer data platform (CDP) and the email software, so that she never receives offers by email.
Six months later, she asks the store to delete her account. The software opens a request, confirms her identity, and looks up the data map. The data map is a list of every system that holds personal data. Here it lists nine systems, including the order database, the courier company's system and the support chat tool. The software sends a deletion task to the owner of each system, and tracks each task until it is done. Some records, such as tax invoices, must be kept by law for some years, so those are kept and noted. Finally, she receives a confirmation.
The data map is the hardest part to keep correct. Newer tools build it automatically, by reading the company's code and systems to see where each type of personal data is sent, including into AI models. They also use the labels from data security posture management (DSPM) to know where personal data is stored. Personal data sent to outside companies, such as the courier, connects privacy work to third-party risk management (TPRM). And each privacy risk is recorded in the company's GRC platform, the register of all its risks.
Privacy management is not the same as protecting the data. Privacy software records what the company may do with the data, and why. Tools for data protection make the data itself hard to misuse. For AI systems, the same duties are checked by AI governance.