This paper explores the application of the DUCA (Data Usage Control and Compliance Architecture) framework for privacy management in Cyber-Physical Systems (CPS). DUCA integrates Privacy-by-Design (PbD) principles, Privacy-Enhancing Technologies (PETs), and context-aware policy enforcement to support regulatory compliance and protect data throughout its lifecycle. A key focus of this work is the integration of Secure Elements (SEs)—including Trusted Execution Environments (TEE), Trusted Platform Modules (TPM), and Intel SGX—to enable privacy protection during data processing, complementing traditional safeguards for data at rest and in transit. The framework also supports emerging standards such as DICE and MARS to facilitate scalable trust management in heterogeneous CPS environments. We present DUCA’s modular architecture and evaluate its applicability across representative use cases, including smart grids, eHealth, and AI-enabled infrastructures, demonstrating its effectiveness in enforcing privacy without compromising functionality.