A graph-based data privacy compliance solution is disclosed. In various embodiments, a privacy graph database based at least in part on an associated privacy graph model is used to store private information of a person, including by including in the privacy graph database a node representing a critical data element comprising the private information of the person.