Privacy and Security Alignment for SaaS

Note: Map data subject rights, retention, and DPIAs to concrete security controls and vendor requirements.