GDPR compliance is not a banner. It is a privacy operating system.
Captain Compliance connects consent enforcement, continuous website scanning, privacy notices, data-subject requests, lawful-basis records, DPIAs, vendor oversight, international transfers, breach workflows, and audit evidence in one robust GDPR privacy platform.
TCF 2.2 native. Consent Mode v2 native.
If you sell ads, you need IAB TCF v2.2. If you run Google Ads or Analytics, you need Consent Mode v2. Most CMPs stitch these on top. Ours treats them as first-class, receipts include TC strings, Consent Mode signals fire in <40ms, and our Google partnership pre-dates the deprecation deadline by 18 months.
IAB TCF 2.2, certified CMP
We’re registered with the IAB Europe TCF as CMP ID 412. Every consent emits a valid TC v2.2 string, with the full vendor list, purpose disclosures and special features per Annex VII. We participate in the IAB’s biannual conformance review.
REGISTERED · CMP-412 · VENDOR LIST 354Google Consent Mode v2, partner
Both basic and advanced modes supported. Conversion modelling preserved on rejection. Ad personalisation signals correctly suppressed for EU/UK visitors. Approved as a Google Certified CMP for the post-March 2024 enforcement.
CERTIFIED CMP · GTM TAG TEMPLATEEach one mapped to a workflow in your dashboard.
Lawful basis
Every processing purpose needs an appropriate Article 6 basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Legitimate interests require a documented necessity and balancing assessment, not a blanket declaration. Receipts carry the basis at tag-level granularity.
Valid consent
Consent must be freely given, specific, informed, and unambiguous, given by clear affirmative action, demonstrable, and as easy to withdraw as it was to give. A click on accept is not sufficient on its own. The withdraw flow carries identical UX weight to accept.
Special-category data
Racial or ethnic origin, political opinions, religious beliefs, union membership, genetic, biometric, health, sex-life, and sexual-orientation data require an Article 9 condition in addition to an Article 6 basis. Flagged and tracked separately in your processing register.
Notice obligations
Layered privacy information covering controllers, purposes, legal bases, data categories, recipients, retention, international transfers, rights, complaints, and DPO contact where applicable. Versioned and change-tracked via Hosted Privacy Notices.
Subject rights
Access, rectification, erasure, restriction, portability, and objection, routed through the DSAR Portal with authentication, deadline tracking, and response records. No GDPR right is absolute — each carries its own conditions and exceptions.
Automated decisions
Flags any system performing solely automated decisions with legal or similarly significant effect, and builds in human review, meaningful information about the logic involved, and the ability to contest the outcome.
Records of processing
Connect each purpose to its data categories, data subjects, legal basis, recipients, vendors, transfers, retention period, safeguards, and responsible owner. Limited exemptions apply, though many recurring or higher-risk activities still warrant documentation.
Security of processing
Technical and organisational measures appropriate to the risk, with SOC 2 Type II, ISO 27001 and ISO 27701 audit evidence available in your Trust Center under NDA gating.
Breach notification
Notify the supervisory authority without undue delay and, where required, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to rights and freedoms. Not every breach must be reported — but every breach must be documented, along with the reasoning behind the notification decision.
DPIA workflow
Required when processing is likely to result in a high risk to individuals’ rights and freedoms, not for every project. EDPB-aligned template wired into your processing register, covering necessity, proportionality, safeguards, consultation, and approval.
The patterns DPAs actually look at.
Dark-pattern shield
Supervisory authorities, CNIL among the most explicit, have made clear that reject must carry equal weight to accept. Our defaults are built to that standard, and we block configurations that undermine it.
noyb and complaint watch
Privacy advocacy groups file complaints continuously across member states. We track active cases and adjust default configurations as arguments and decisions develop.
Transfer impact assessments
Transfers outside the EEA need an appropriate Article 46 mechanism and, where relevant, a transfer impact assessment. Signing Standard Contractual Clauses does not by itself complete the analysis. We flag vendors that trigger one, with template wording you can hand to your DPO.
Local-language experiences
Consent experiences, notices, and receipts localised for the member states you operate in — translated by people, not machine output.
Multi-member-state DPA logic
Lead supervisory authority, one-stop-shop, and joint investigation rules. We surface which authorities are likely to see a complaint and how they have approached comparable issues.
ePrivacy and cookie rules
Rules on storing or accessing information on a user’s device arise primarily from the ePrivacy Directive and national implementing law, with the GDPR setting the standard that consent must meet. The proposed ePrivacy Regulation was withdrawn, and the Digital Omnibus package would move cookie rules into the GDPR — but it remains a proposal, not law. We track the position per member state and will not change your defaults on the basis of a proposal.
EU GDPR and UK GDPR
The UK operates its own GDPR alongside the Data Protection Act 2018 and PECR, with its own regulator and its own cookie rules. We keep the two configurations distinct rather than treating the UK as an extension of the EU.
If a DPA fines you on tracker patterns, we pay the legal bill.
Compliance Shield covers GDPR Art. 7 challenges, ePrivacy cookie-banner cases, and the full body of EDPB-derived enforcement up to €1.85M per incident (Pro tier) or €2M (Enterprise). Underwritten in part by a Lloyd's syndicate.
Read the Shield contract →UP TO €2M PER INCIDENT
- · DPA enforcement actions (Art. 7, ePrivacy)
- · noyb & CIDP class actions
- · TCF compliance challenges
- · DPC, CNIL, Garante, AEPD, BfDI & 27 more
Make GDPR accountability part of how your organization actually handles data.
Connect consent enforcement, continuous scanning, privacy notices, data-subject rights, lawful bases, DPIAs, vendors, international transfers, breaches, and audit evidence in one robust privacy platform.
Book a GDPR privacy review See Consent Management