Consent & Privacy Service  ·  View 01 of 22  ·  Context and scope

System Context

Eleven things outside the boundary, three of which want to be told no, and one that is not a system at all.

Editable source SVG draw.io All views
Governance Purpose owner 40 product teams Legal & privacy counsel approves the basis People who act Data subject 180 M registered Support agent case-bound access Privacy officer one per jurisdiction First-party systems (40) Product services decision on read path Marketing platform campaign eligibility Analytics warehouse derived data Feature store & models re-derived on erasure Consent & Privacy Service Permission, rights, evidence Outside the company Processors 60 recipients Manual recipients no API Supervisory authority 3 jurisdictions grants, withdraws, requests acts on request evidence, findings asks a decision withdrawal feed suppression list rebuild trigger declares purposes approves basis erasure manual, tracked requests evidence Consent & Privacy Service — System Context Person or role External / third party synchronous event / async batch Out of scope: storing personal data itself, authentication, campaign execution, the banner's front-end. v 1.0 · owner Security & Identity Architecture · date 2026-10

Decisions

  • The boundary holds permission and the orchestration of rights. It does not hold personal data — the forty first-party systems keep theirs and must ask.
  • The supervisory authority is drawn as an actor with an inbound arrow, because answering it is a designed capability and not an escalation path.
  • Processors are split into programmatic (60) and manual, because a recipient with no API is a different architectural object: a tracked obligation with an owner.

Assumptions

  • 180 million registered subjects, 40 internal processing systems, 60 external recipients, 3 jurisdictional boundaries, 9 regional deployments.
  • Legal counsel approves the lawful basis per jurisdiction; the platform enforces that approval rather than deciding it.

Omissions

  • Authentication, campaign execution and the banner's front-end are out of scope and not drawn.
  • The forty first-party systems appear as four classes, because their differences that matter are their erasure technique and their verification capability, shown in view 14.
All views High-Level Architecture  ▶
Solution Architecture v1.0 · Amazon Web Services · Security & Identity Architecture · 2026-1001-system-context