What Privacy Tools Does My Business Need?

It depends on which laws apply to you and what personal data you hold. If you're covered by the GDPR or a US state privacy law, you'll usually need consent or opt-out handling on your website, a way to answer subject rights requests on time, contracts with the vendors that handle personal data, and a record of what you hold and where it goes. Assessments come into play for higher-risk processing, like selling data, running targeted ads, or processing sensitive data. The assessment on this page maps your answers to each of these areas.

Do I Need More Than a Cookie Consent Banner?

Usually, yes. A banner handles one job: collecting and recording consent or opt-outs for trackers on your website. Subject rights requests, a record of where personal data lives, and contracts with your vendors all sit outside it. If any of those apply to you, a banner on its own leaves gaps.

When Do I Need Data Subject Access Request Software?

Once requests start arriving faster than one person can track them, or once you're juggling more than one set of deadlines. Software handles intake, identity checks, routing to the teams that hold the data, and an audit trail of what you did and when. If requests live in an inbox and a spreadsheet today, it's worth a look.

What Is Vendor Risk Management in Privacy?

It's how you track the vendors that receive personal data from you and check how they handle it. That means knowing which vendors hold which data, putting privacy terms in your contracts, reviewing vendors before you share data with them, and checking in afterward. When a customer sends you a security questionnaire, this is often where gaps show up.

Products
Explore
See how teams run privacy on Osano Lattice, Fender, and the American Society of Anesthesiologists share how they use Osano to reduce risk. Read customer stories
By regulation
By company size
Switch
- Switch to Osano Move off OneTrust or another tool, with our team guiding the switch.
Switching from OneTrust? See what the move looks like, with our team guiding it. See the switch
Learn
7 things privacy regulators look for on your website A checklist you can run against your own site today. Read now
Check
- Compliance Check Get a free one-time scan of your site from our privacy team.
- Enforcement Tracker Privacy fines and enforcement actions, by law and region.
Assess
- Privacy Stack Assessment
Calculate
- OneTrust Migration Check Get a realistic timeline for moving off OneTrust.
Is your website compliant? Find out free. Our privacy team scans your site, then advises you on what to fix first. Run the check
Plans

Get started

Plans Get started Get started Login

Privacy Stack Assessment: Find Your Privacy Gaps

Privacy Stack Assessment

Find Out What Privacy Tools Your Business Needs

Q: What Is a Privacy Impact Assessment, and Do I Need One?

A privacy impact assessment (PIA) reviews how a project or process uses personal data, what could go wrong, and how you'll reduce the risk. Under the GDPR, it's a data protection impact assessment (DPIA). Under US state laws, it's a data protection assessment or a risk assessment. The GDPR calls for an assessment before processing that's likely to be high risk. Several US state laws, like Colorado's and Virginia's, call for one before you sell data, use it for targeted ads, process sensitive data, or use it for some kinds of profiling. Even where one isn't required, a PIA gives you a record of the decisions you made.

Answer 10 quick questions. You'll see what's in place, what's missing, and what to fix first.

Question 1 of 10

Do you have a cookie consent banner on your website?

Consent is the part of your privacy program visitors see first.

Yes, and it adjusts by location (opt-in, opt-outs, and Global Privacy Control where each is required) We use a banner that came with our CMS or a banner plugin No banner yet We only use essential cookies Not sure

How do you handle data privacy requests (DSARs) today?

Under laws like the GDPR and CCPA, the response clock usually starts when a request arrives, not when someone opens it. That's one month under the GDPR and 45 days under the CCPA, with limited extensions.

With a workflow that tracks each request to close By hand, with email and a spreadsheet We don't have a process yet Not sure

Do you know what personal data your company collects and where it's stored?

Most other privacy work depends on knowing what you hold and where it goes.

Yes, it's documented and kept current Partly, for some systems No Not sure

Do you assess privacy risk before you start higher-risk processing?

The GDPR calls for an assessment before processing that's likely to be high risk. Several US state laws, like Colorado's and Virginia's, call for one before you sell data, use it for targeted ads, process sensitive data, or use it for some kinds of profiling.

Yes, and we keep the records We've started but haven't finished No We don't think we do anything that needs one Not sure

Do you have contracts and reviews in place for vendors that handle personal data?

Almost every business uses vendors that handle personal data, like hosting, email, and payment providers.

Yes, contracts with privacy terms and ongoing reviews Contracts, but we only review vendors at onboarding Not consistently Not sure

Do you know which privacy laws apply to you, and do your consent and request processes adjust by location?

Each state and country can set its own rules for consent and requests.

Yes, and our processes adjust by location We know which laws apply, but our processes don't adjust No Not sure

Where are your customers?

This doesn't change your score. It helps us put the right items first.

United States only United States and other countries Outside the United States only Not sure

Have you updated your privacy policy in the past 12 months?

Your policy should describe what you actually do with personal data today. If California's CCPA applies to you, it also requires an update at least once every 12 months.

Yes, within the past 12 months We have one, but it's older than that We don't have one Not sure

If you got a privacy complaint, demand letter, or regulator inquiry tomorrow, do you have a plan for responding?

If one arrives, you'll need to show what you did and when.

Yes, a written plan and records to back it up Some of it, not written down No Not sure

Have you received a privacy complaint, demand letter, or regulator inquiry in the past 12 months?

This doesn't change your score. If the answer is yes, we'll put it at the top of your results.

Yes No Not sure

Pick an answer to keep going. "Not sure" counts.

"Not sure" is a fine answer. We score it separately from gaps and flag it, because anything you can't confirm is worth checking first.

10 of 10 answered

Next Step

Get a Demo With Your Results

Fill out the form, and pick a convenient time for a short call. Bring your results with you, and we'll show you how Osano helps with each area on your list.

Get a Demo With Your Results

The Osano Platform

How Osano Helps

These are the products this assessment can match you to, and the signs that it's time for each one.

Cookie Consent

Banners you can set up for each region's consent rules. They can block trackers until consent where the law requires opt-in, can honor Global Privacy Control signals, and keep a record of every choice.
When you need it: you have visitors from more than one state or country, or your banner doesn't change what loads based on their choice or a Global Privacy Control signal.
Learn more

Subject Rights

Intake, identity checks, routing, and an audit trail for access, deletion, and correction requests.
When you need it: requests arrive by email, land in one inbox, and get tracked in a spreadsheet.
Learn more

Data Mapping

A living inventory of the personal data you hold, where it lives, and who it's shared with.
When you need it: answering a deletion request or a security questionnaire means asking three teams where the data is.
Learn more

Assessments

Templates and review workflows for privacy assessments, with a record you can share.
When you need it: you're about to sell data, run targeted ads, process sensitive data, or use personal data in a new way.
Learn more

Vendor Privacy Risk Management

A record of the vendors that handle your personal data, with reviews that continue after onboarding.
When you need it: personal data reaches vendors you reviewed once and haven't checked since.
Learn more

Regulatory Guidance

Updates when privacy laws change in the regions you follow, so you know what's coming.
When you need it: your customers are in more than one state or country, and you're unsure which rules apply.
Learn more

Privacy Templates and TrustHub

Privacy policy and notice templates, plus a public page that shows customers how you handle their data.
When you need it: your privacy policy is due for an update, or customers keep asking how you protect their data.
Learn more

Privacy Experts

Depending on your plan, access to Osano's privacy team for questions about your program.
When you need it: a complaint, a new law, or a customer question needs an answer from someone who knows privacy.
Learn more

Join thousands of companies winning consumer trust with Osano

From Osano Customers

What Customers Say

In their own words, from verified reviews on G2, where Osano is rated 4.5 out of 5 based on 170+ reviews.

"It is hard to keep track of third-party cookies in an enterprise where several departments can add cookies. Osano helps take that back under control."

Martin V.

Information Security Officer and Software Quality Manager, G2 Reviewer

"Ability to implement very quickly to sites with the CMP, clone configurations, make changes and finalize deployment through publishing. ... Customer service is excellent as they provided rapid guidance on what was possible and impossible."

Christopher C.

Head of Information Security and Compliance, G2 Reviewer

Frequently Asked Questions

Questions About Privacy Tools

See Osano in Action

Close Your Gaps in the Right Order

See how Osano brings consent, data requests, data mapping, assessments, and vendor risk into one platform. Bring your results, and we'll walk through them with you.

4.5/5 based on 175+ reviews

Get a Demo Take the Assessment

The Simple, All-in-One Data Privacy Platform

Subscribe to Osano news & insights

Products

The Osano Platform Cookie Consent Consent Management Platform Unified Consent & Preference Hub Subject Rights Management Data Mapping Vendor Management Assessments Compliance Check TrustHub Privacy Templates GDPR Representative Regulatory Guidance Consult Privacy Team Audit Defense AI-Powered Osano

Company

About Us Careers Contact Data Licensing Our Guarantee Partners & Resellers Partner Resources Press & Media

Resources

Migrate to Osano Osano vs OneTrust Articles Podcast Customer Stories Resource Center Events Newsletter Privacy Program Maturity Model FAQs Plans Schedule a Demo Product Updates Documentation Developer Documentation System Status Open Source Sitemap AI Instructions

Legal

Cookies DPA Privacy Terms APRA Trust Center

© 2018 - 2026 · Osano, Inc., a Public Benefit Corp · Osano is a registered trademark of Osano, Inc. a Public Benefit Corporation · Nothing on the Osano website, platform, or services, nor any portion thereof constitutes actual legal or regulatory advice, opinion, or recommendation by Osano, Inc. a Public Benefit Corporation, Osano International Compliance Services LTD, or Osano UK Compliance LTD. If legal assistance is required, users should seek the services of an attorney.