Tick a box only when the vendor has shown you the thing working or put it in writing. A sales deck saying "yes" doesn't count. Each section keeps its own score, and the overall score at the bottom counts only the sections you haven't marked as not relevant.
We build the systems this checklist asks about. Opsware designs and implements data and automation systems as part of its engineering services work.
This checklist is for teams buying tools that handle data discovery and mapping, data subject requests (DSRs), consent and cookie management, or a suite that does all three. It goes with the longer write-up, Choosing privacy software without regretting it, which covers build vs. buy, how to run the evaluation and what total cost really includes. Nothing you tick leaves your browser. The page has no forms, sends nothing anywhere and stores nothing.
1. Data discovery and mapping
This is where a lot of the value is, and where demos tend to oversell it. "Discovery" can mean anything from scanning column names to classifying the content inside unstructured files. Find out which one you're getting. For background on what a usable map contains, see Data mapping and discovery and Data maps and ROPAs.
Questions to ask in the demo
- Connect to one of our real systems (or a copy) during the trial. How long does the first scan take, and what does it miss?
- Show us a false positive and walk through how we correct it.
- Is classification done inside our environment, or is sampled data sent to your cloud? Which fields get sent?
- What happens to the map when a table is renamed or a new SaaS app is added?
- Export the ROPA right now. Which fields come out empty and need a human to fill in?
2. Data subject request automation
A DSR tool has to take a request in, verify the person, find their data across systems, act on it, and prove what it did, all inside the legal deadline. Most products are strong on intake and workflow but weaker at the "find and act" part. The mechanics are covered in Data subject request automation and How privacy request automation tools work.
Questions to ask in the demo
- Submit a deletion request as a test user and follow it end to end. Which steps were automatic and which were manual?
- What happens when a connected system's API call fails halfway through a deletion?
- How do you match a requester to records when email addresses differ across systems?
- How do you handle a burst of agent-submitted requests that arrive without individual verification?
- Show the audit log for a closed request. Could we hand it to a regulator as-is?
3. Consent and preference management
Consent tools sit on your website and apps, so they affect page speed, tag firing and what your marketing team can measure. The legal part that changes most often is opt-out signal handling in US states, which is covered in the website privacy audit.
Questions to ask in the demo
- Turn on GPC in a browser and load our staging site with your banner. What changes, and where is it logged?
- What does the banner do before the script finishes loading? Do any tags fire in that gap?
- How do consent choices reach our ad platforms and CDP? Is that sync real-time or batched?
- Who updates the cookie categories when a new tracker shows up?
4. Security and hosting
A privacy tool that indexes your personal data is itself a high-value target. It often ends up holding a copy of the most sensitive fields you have. Treat this section like a vendor security review, and read the vendor's DPA alongside it (see Data processing agreements and Security controls for personal data).
Questions to ask in the demo
- For each feature we'd use, what personal data do you store, where, and for how long?
- Who holds the encryption keys? If we revoke a customer-managed key, what stops working?
- Can we have the full SOC 2 report under NDA, not just the bridge letter or a trust-page badge? What were the exceptions?
- Which of your engineers can access our tenant, under what approval, and is that logged where we can see it?
- Which sub-processors touch our data, and in which countries?
5. Integration effort
Integration effort is what demos hide best. A connector that "exists" may only read metadata, need admin credentials you won't grant, or need ongoing upkeep from your engineers.
Questions to ask in the demo
- For our five most important systems, show the connector settings screen and the permissions it asks for.
- Which customer-built integrations break most often after upstream API changes, and who fixes them?
- What does a typical implementation look like week by week, and what usually causes delays?
- Is implementation included, a fixed fee, or billed by the hour?
6. Pricing and total cost
Privacy tools are priced on very different units: data sources, records, employees, domains, requests, or modules. Two quotes that look alike can grow very differently. The data map cost page explains what drives the cost of the manual alternative.
Questions to ask in the demo
- What exactly are we counted on, and how is it measured? Who measures it?
- Price the same scope for year three assuming we double our data sources.
- Which features in today's demo are add-ons?
- What's the renewal uplift cap you'll put in the order form?
7. Exit and data export
Privacy vendors get acquired, merge products and shut down. Plan for leaving before you sign. If the tool holds your ROPA, consent records and DSR audit trail, those are compliance records you need to keep after the contract ends.
Questions to ask in the demo
- Export everything from the trial tenant now. How long did it take, and is it usable without your product?
- After termination, how many days do we have to retrieve data, and how do you confirm deletion?
- Has a customer migrated away from you? What did they take with them?
Overall result
Reading the score
The percentage is a way to compare vendors you've tested the same way. It isn't a pass mark. A vendor at 70% with every must-have ticked is usually a better bet than one at 85% that can't show you where your data is stored. Here's a rough guide:
| Result | What it usually means |
|---|---|
| All must-haves ticked, 75% or more overall | Strong fit. Negotiate the gaps into the contract or the implementation plan. |
| All must-haves ticked, under 75% | Workable. Check whether the unticked items are things you'll need in the next year or two. |
| One or more must-haves missing | Get a written commitment with a date, or keep looking. Roadmap promises in a demo are not commitments. |
If several vendors score similarly, the deciding factor is usually integration effort with your specific systems, which only a proof of concept on real (or realistic) data will show. For how to structure that, and the red flags to watch for, read Choosing privacy software without regretting it. To see where each kind of tool fits, see The privacy tech stack, layer by layer.
Need this built?
If you would rather have this implemented than read about it, tell us about your project and we will reply with questions or a rough plan.