<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Privacy Governance Assessment

## Privacy Management Platforms

### OneTrust API

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/api/datasubject/v3/requestqueues` | GET | List data subject requests |
| `/api/assessment/v2/assessments` | GET | List privacy assessments |
| `/api/inventory/v2/processingactivities` | GET | List RoPA entries |
| `/api/consentmanager/v1/consentreceipts` | GET | Consent receipt records |
| `/api/vendorrisk/v2/vendors` | GET | Third-party vendor inventory |

### BigID API

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/api/v1/data-catalog` | GET | Data discovery results |
| `/api/v1/sar` | POST | Submit subject access request |
| `/api/v1/policies` | GET | Privacy policy inventory |
| `/api/v1/risk-assessment` | GET | Privacy risk scores |

## Regulatory Requirements Reference

| Regulation | Scope | Key Articles |
|-----------|-------|-------------|
| GDPR | EU/EEA residents | Art. 6, 13-22, 30, 35, 44-49 |
| CCPA/CPRA | California residents | §1798.100-199 |
| HIPAA | US health data | §164.502-514 (Privacy Rule) |
| LGPD | Brazil residents | Art. 7, 18, 33, 38 |
| POPIA | South Africa | §8-25 (Conditions for Processing) |

## DPIA Templates

| Standard | Template Source |
|----------|---------------|
| ICO (UK) | ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/data-protection-impact-assessments-dpias/ |
| CNIL (France) | PIA tool: cnil.fr/en/privacy-impact-assessment-pia |
| Article 29 WP | Guidelines on DPIA (WP 248 rev.01) |
| ISO 27701 | Annex D — DPIA process mapping |

## Data Subject Rights

| Right | GDPR Article | Response Time |
|-------|-------------|---------------|
| Access | Art. 15 | 30 days |
| Rectification | Art. 16 | 30 days |
| Erasure | Art. 17 | 30 days |
| Restriction | Art. 18 | 30 days |
| Portability | Art. 20 | 30 days |
| Objection | Art. 21 | 30 days |
| Automated Decision | Art. 22 | 30 days |
