* right to be forgotten (deleting user & all related data)

Doable with CB Privacy using the profile delete field. All of our plugins that store user data usually by default also delete the users data when that user is deleted (optionally toggled off). Additionally CB Auto Actions could be used to act on the user delete trigger if you need to delete data that isn't a part of CB on user delete. This does not need to be automated as per the law so you can be compliant by also just deleting the users data on request if you do not have access to CB Privacy.

* data portability (ability to export all their data in a portable format, eg. xml/json)

This does not need to be automated as per the law so you can be compliant with these requests by simply doing a CSV database dump of their data when they request for it (honestly not likely to happen often if at all). If you do want to automate it you can probably use CB Auto Actions and a Code action that just JSON encodes the user object and outputs that JSON string to them. Code field could also do it.

* data protection (eg encryption) of personal identifiable data in case of a data breach

Nothing to do with CB. Basically ensure you've HTTPS. Passwords are already encoded. Regular profile data of course is not (it has to be reversible to even be displayed). Believe this is mostly for encryption of personal ID numbers (e.g. SSN in the US would be a personal identifiable number; no idea what EU equivalent is) and things like credit card numbers, which should already be encrypted if stored based on best coding practices alone (CB doesn't store any of that unless you added fields for it).

* explicit consent for different data usages.

Nothing to do with CB. Be sure your terms and conditions includes the appropriate data use section.

See my reply above. I've already explained how you can do that. CB Juice can give a CSV dump or you can directly dump from the database using phpmyadmin. This does not have to be automated. Just provide the dump if a user requests one. CB Privacy will eventually provide a field to dump profile data.

You are likely to get 1, if that, request for data dump per year. It is not likely people will bother with it. At any rate that functionality is planned for CB Privacy. Joomla is also implementing it into Joomla core in Joomla 3.9, which we will likely integrate with.