Data privacy management is sold as a category and lived as five separate jobs that happen to share a vocabulary. Knowing which of the five you are missing is worth more than any comparison of platforms, because the jobs have different owners, different costs and a strict order: doing the fourth before the first produces an expensive process nobody can run.
The five jobs
Know what you hold and why, which is the register. Publish what you do, which is the privacy notice, the cookie document and the terms. Record what people agreed to, which is consent and preferences. Answer what people ask, which is the access, deletion, correction and opt-out process. And bind the vendors who touch the data, which is the agreements and the sub-processor list. Every duty in every one of these statutes is a restatement of one of those five in a particular jurisdiction's words.
The order is not negotiable
The register comes first because everything else quotes it. The notice comes second because you cannot describe processing you have not listed. Consent comes third because it attaches to purposes the notice names. Requests come fourth because answering one means searching the systems the register lists. Vendors come last only in sequence, not in importance: it is the job most often started first, because a vendor questionnaire is easy to send, and it produces nothing usable until you know which vendors matter.
What software is actually for
Two of the five benefit from tooling early. The request process benefits because it has a clock, a chain of custody and an evidential record, and an inbox thread is a poor version of all three. The consent record benefits because it has to survive being questioned a year later, which means a timestamped, versioned log rather than a flag on a row. The other three are documents. Buying a platform to hold documents you have not written is buying a filing cabinet before owning any files.
What to measure
Four numbers tell you whether the work is real. How many requests arrived and how many were answered inside the deadline. How many systems in the register were reviewed this quarter. How many vendors receiving personal data have a signed agreement, against the total. And how many statements in the published notice have been verified against reality this year. None of those is a compliance score, and all four are answerable from records you should have anyway.
Questions people ask about data privacy management
Is this the same as a privacy programme?
A program usually means the same five jobs plus governance: who owns it, who reviews it and how often. For a small company the governance is one named person and a calendar entry.
Where do most small companies fail?
The vendor list and the request clock. The first because nobody counts the tools, the second because a request arrives in an ordinary inbox and the deadline runs from the day it arrived, not the day it was noticed.
Can one person do all five?
At this size, yes, and it is usually better than spreading it, because the five jobs share one register and a shared register with several owners goes stale in every direction at once.
How long does the first pass take?
For a company with a website, a CRM, a mailing tool and a support inbox, a focused week gets the register, the notice and the request process to a state you can defend, and the vendor agreements then take as long as the vendors do.