Technical Deep Dive
How Privacy Rights Automation Works
Graph-based discovery. Cascade-aware deletion. Contract blocking. Data portability export. Here is exactly what happens when a data subject submits a privacy request.
The Privacy Rights Pipeline
From request intake to auditable proof of compliance
Request
Data subject submits a privacy request
A DSAR (Data Subject Access Request) or RTBF (Right to Be Forgotten) request arrives. Privacy Rights accepts requests via UI, REST API, or integration with OneTrust, TrustArc, and MuleSoft.
Discovery
Graph engine finds every related record
Input an email address or customer ID. The graph engine discovers every related record across Sales Cloud, Service Cloud, Marketing Cloud, and custom objects without manual SOQL queries. No missed data. Complete visibility.
Review
Legal review and contract blocking
Before deletion executes, Privacy Rights checks business constraints. Running contracts block deletion in financial services scenarios. Legal review is built into the workflow.
- Inspect contract status before executing deletion on related Contacts
- Queue deletion requests when contracts are active; execute when contracts close
- Flag records under litigation hold for exemption from deletion
Execute
Cascade-aware deletion in safe batches
Deletions execute in governor-limit-safe batches. Master-Detail relationships are handled correctly. Related records across Cases, Contacts, Opportunities, and custom objects are deleted or anonymised in a single coordinated run.
Audit
360-degree audit trail generated
Every action is logged: what data was found, what was deleted, when, by whom, and under which regulation. The audit trail exports to PDF or CSV for regulator submission. Full chain of custody. No manual spreadsheets.
Under the Hood
What Privacy Rights does in each phase
Graph-based discovery across all Clouds
Input an email address or customer ID. Privacy Rights' graph engine traces relationships between objects and discovers every related Lead, Contact, Account, Case, Contract, Opportunity, and custom object without manual SOQL queries. The engine also discovers data in Marketing Cloud Contacts and Engagement records.
Manual DSAR processing requires querying objects one by one across Sales, Service, and Marketing Clouds. Privacy Rights automates the discovery step completely: no missed data, no manual effort.
Cascade-aware deletion with contract blocking
Safe deletion that respects Salesforce's relational integrity. Master-Detail relationships are handled correctly. In financial services (loan, revolving credit, insurance contracts), deletion is blocked while the contract is active. Privacy Rights inspects the contract status before executing deletion.
If a contract exists, deletion is held in queue until the contract closes. This prevents deleting records the law says you cannot touch while a business relationship is active.
Governor-limit-safe batch processing
Large DSAR requests (500K+ records) execute in safe batches without hitting Salesforce DML limits (10K rows). Deletion completes reliably. Progress is tracked. No manual intervention required during bulk delete.
Manual deletion creates cascade problems: delete a Contact and you might accidentally delete Cases or Opportunities attached to it. Privacy Rights handles the ordering and batching to prevent data loss.
Data portability export
CCPA requires portable data in machine-readable format. GDPR Article 20 requires the right to data portability. Privacy Rights generates formatted data exports automatically for the data subject, covering all discovered records across objects.
No external tools required. The export is generated from the same discovery graph used for deletion, ensuring consistency between what was found and what is provided to the data subject.
360-degree audit trail for every request
Privacy Rights creates a comprehensive audit trail: what data was found (timestamp, object, field count), what was deleted (Contact ID, related Cases, Contracts), deletion success or failure, executed by (user), and approval chain if required.
The log exports to PDF or CSV for regulator submission. Auditors get proof of compliance. Internal audit reviews have concrete evidence. No 'we think we deleted it' uncertainty.
Architecture
100% inside your Salesforce org
Privacy Rights Automation is a managed package. Every component (discovery UI, deletion engine, and audit trail) runs inside your Salesforce org as native Apex. No external infrastructure. No data leaves your environment.
Salesforce Org
Privacy Rights Managed Package
Request Intake & Discovery UI
Lightning / Visualforce
Accept DSAR/RTBF requests via UI or REST API. Graph-based discovery visualises all related records before deletion. Legal review workflow built in.
Graph Engine & Business Rules
Custom Objects + Custom Settings
Object relationship graph, contract blocking rules, litigation hold flags, and deadline tracking stored natively in Salesforce Custom Objects.
Deletion Engine + Audit Trail
Apex Batch Processing
All deletion execution, cascade handling, portability export, and audit logging runs as managed Apex code within your org. No external compute. No outbound data movement.
Graph engine traces object relationships automatically: no manual SOQL required for discovery across Sales, Service, and Marketing Clouds
REST API endpoints enable integration with OneTrust, TrustArc, MuleSoft, and any enterprise privacy platform
Hub-and-spoke orchestration supports multi-org privacy rights workflows from a single management console
Your Options
Privacy Rights vs the alternatives
How Privacy Rights Automation compares to manual DSAR processing and external privacy tools.
| Dimension | Privacy Rights | Manual Process | External Tool |
|---|---|---|---|
| Discovery | Automatic: graph engine finds all related records | Manual: query objects one by one | Varies: depends on connector coverage |
| Cascade safety | Built-in: contract blocking, Master-Detail handling | None: risk of accidental deletion | Varies: tool-dependent |
| Time per request | Minutes: 1-click execution | 2+ weeks: multi-team coordination | Hours to days: tool-dependent |
| Cost per request | $180-$350 (automated) | $1,524 average (Captain Compliance) | Varies by vendor |
| Audit trail | Automatic: 360-degree log | Manual: spreadsheet-based | Varies: may require separate logging |
| Data portability | Built-in: machine-readable export | Manual: CSV creation per object | Varies: tool-dependent |
Technical Specifications
Request types
DSAR, RTBF, Data Portability, Correction
Discovery method
Graph-based: automatic across all Clouds
GDPR deadline
30-day response: met consistently
CCPA deadline
45-day response: met consistently
HIPAA deadline
60-day response: met consistently
Cascade handling
Master-Detail + contract blocking
Bulk processing
500K+ records in governor-safe batches
Cost savings
$1,400+ per request vs manual processing
Integration
REST API: OneTrust, TrustArc, MuleSoft
Multi-org
Hub-and-spoke orchestration supported
Deployment method
Managed package via AppExchange
Release quality
107 regression tests, 240 hours testing per release
Frequently Asked Questions
See Privacy Rights process a DSAR in 1 click
30-minute technical demo. We show you graph-based discovery, cascade-aware deletion, contract blocking, and the 360-degree audit trail on a real Salesforce org.