GDPR compliance software for a small business
For a firm of a few dozen people with no data protection officer, working through the GDPR on its own. 6 GDPR suites, measured against the files the regulation asks a small controller to keep: the Art. 30 record, the request log, processor contracts, impact assessments and the breach log, from each vendor’s own pages. read 2026-10-22
Best overall
heyData
Its own pages say yes on every row, and a certified external DPO works inside the same platform.
Best free start on the Art. 30 record
PrivacyPerfect
The free plan holds the processing inventory and DPIA pre-assessments; add the other modules when you need them.
Best for a firm with its own privacy lead
GDPR Register
Published plans with unlimited users, and the entry plan already covers the record, processors, breaches and requests.
The GDPR files, suite by suite
Each row is something the regulation asks of a controller, with the article it comes from. Read across for one requirement; read down for one suite. The first five rows are the files a small firm actually keeps; the last three decide who does the work and where the data sits. Our GDPR checklist shows which rows you already cover before you buy anything.
| Requirement | heyData | DataGuard | Proliance 360 | GDPR Register | PrivacyPerfect | Vanta |
|---|---|---|---|---|---|---|
| Keeps your record of processing activitiesGDPR Art. 30(1) | yeswith an authority export | yes | yes | yes | yeson the free plan | yes |
| Logs data subject requests against the deadlineArts. 15–22; Art. 12(3) | yes | yeswith a web form | yesnamed in its FAQ only | yesweb form not yet live | paid plan | not stated |
| Tracks processors and their contractsGDPR Art. 28(3) | yes | yes | yes | yes | paid plan | yesreads vendors' DPAs |
| Runs a DPIA from a templateGDPR Art. 35(1) | yes | yes | yes | paid plan | paid planpre-assessment free | yes |
| Keeps a breach log, reported or notGDPR Art. 33(5) | yes72-hour deadline tracked | yes | yesdeadline tracking | yes | paid plan | not stated |
| Trains staff on data protectionGDPR Art. 39(1)(b) | yeswith certificates | yes | yes | not stated | not stated | yessecurity awareness |
| Offers an external DPOGDPR Art. 37(6) | yes | paid planadd-on | yessold with the software | not stated | not stated | not statedpartner services |
| Says where it hosts your dataChapter V transfers (Art. 44) | yesEuropean provider | not stated | yesEuropean servers | yesAWS, Frankfurt | yesthe Netherlands | not stated |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | ||||||
The five files the software keeps for you
Strip away the dashboards and a GDPR suite for a small firm is a filing system for five documents the regulation names. A supervisory authority can ask for any of them. Each has its own trigger and its own clock, and that is what the tools are really competing on: whether they remind you before the clock runs out.
| File | When you keep it | The clock |
|---|---|---|
| Record of processing activitiesArt. 30(1) | All the time, updated whenever a processing activity changes | Made available to the supervisory authority on request (Art. 30(4)) |
| Request logArts. 15–22 | Each time a person asks to see, correct, erase or move their data, or objects | Answer within one month, extendable by two further months (Art. 12(3)) |
| Processor contractsArt. 28(3) | One for each vendor that handles personal data on your behalf | Must govern the processing for as long as the vendor does it |
| Impact assessment (DPIA)Art. 35(1) | Before processing likely to result in a high risk to people | Done prior to the processing, not after launch |
| Breach logArt. 33(5) | Every personal data breach, whether you notify it or not | Notify the authority without undue delay, where feasible within 72 hours (Art. 33(1)) |
Source: Regulation (EU) 2016/679 on EUR-Lex, read 2026-10-22. | ||
If you are starting from nothing, start with the record. Every other file leans on it: a request is answered by finding the person in the systems the record lists, a processor contract covers a vendor the record names, and a breach is assessed against the data the record says you hold. Our data map template gets the first draft down before you pick a tool, and the DSAR deadline calculator works out the one-month date for a request already in your inbox.
The exemption for firms under 250 people
“The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data…”
The exemption reads like a pass for small firms, but the three conditions are joined by “or”. Any one of them brings the record back. Payroll runs every month and a customer list is used every week, so that processing is hard to call occasional. In practice most firms with staff or customers keep a record for those activities, and the authority can ask to see it (Art. 30(4)).
The record is the cheapest file to start and the one every other file depends on. A spreadsheet meets the form the regulation asks for: “in writing, including in electronic form” (Art. 30(3)). Software earns its keep when the record has to stay current as vendors and systems change.
Software, or software with a DPO
Of the 6 suites here, 3 are also sold with an external data protection officer, which the regulation allows: a DPO may “fulfil the tasks on the basis of a service contract” (Art. 37(6)). Most small firms are not required to appoint one at all; whether you are depends on your core activities, and our guide to what a data protection officer does walks through the test. If you are required to, or want someone to answer the regulator for you, compare the services themselves on our outsourced DPO services page.
Choose by the file you are weakest on. No record yet: start with a tool whose free or entry plan covers Art. 30. Requests already arriving: make sure the request row says yes, not “not stated”. No one in-house who owns privacy: weigh the suites that come with a DPO.
Each suite in short
What each one is, who it fits, how it meets the rows, and what to confirm with the vendor. If requests are your main load, our DSAR software comparison goes deeper on that one file, and the data mapping software page does the same for the record.
heyData
What it is
A German compliance platform whose GDPR module is sold together with certified data protection officers. It also covers ISO 27001, NIS2 and the EU AI Act.
Who it fits
A small firm that wants the software and a named external DPO from one supplier, with the DPO working inside the same platform.
What the rule requires and whether it meets it
Its GDPR page lists every row: an Art. 30 record with an export for the authority, request workflows, processor agreements under Art. 28, DPIAs, a breach log that tracks the 72-hour deadline, staff training with certificates, and a European hosting provider.
Check with the vendor
Its DPIA and DPA pages also sell drafting by its experts as a consulting service. Ask which work the plan includes and which is billed as consulting.
DataGuard
What it is
A Munich security and compliance platform with GDPR, ISO 27001, TISAX, NIS2 and EU AI Act frameworks. Plans are Base, Pro and Enterprise, all quoted on request.
Who it fits
A firm that needs GDPR now and expects an information security certification next, and wants experts on call.
What the rule requires and whether it meets it
Separate modules cover the record of processing, requests (with a form you embed on your site), processors and sub-processors, DPIA templates, incidents and breaches, and staff training. An external DPO is an add-on.
Check with the vendor
The pages we read do not say where customer data is hosted, or which plan carries which privacy module. Ask for both in writing.
Proliance 360
What it is
The data protection software of Proliance, on the market since 2017, sold on its own or inside an external DPO package.
Who it fits
Small firms in Germany, Austria and Switzerland that want an external DPO and their data on European servers.
What the rule requires and whether it meets it
It has modules for the record of processing, processor agreements, DPIAs and data breaches with deadline tracking, plus annual staff training through its Academy. Its DPO packages include access to the software.
Check with the vendor
Requests are mentioned in its FAQ, but we found no module page for them. Ask to see the request workflow before you rely on it.
GDPR Register
What it is
An Estonian GDPR documentation platform with published plans, unlimited users and one price per legal entity.
Who it fits
A firm with someone in-house who owns privacy and wants the record, processors, breaches and requests in one register without buying consulting.
What the rule requires and whether it meets it
The entry plan covers the record of processing, vendors and DPAs, breaches and data subject requests, with deadline reminders on each request. DPIAs and legitimate interest assessments are on the next plan up. Data sits on AWS in the EU.
Check with the vendor
Its request web form is announced but not live yet. Staff training and a DPO service are not offered on the pages we read.
PrivacyPerfect
What it is
A Rotterdam privacy platform built in modules: processing inventory, assessments, breach register, requests and vendor risk.
Who it fits
A small firm that wants to build its Art. 30 record first on a free plan and add the other modules later.
What the rule requires and whether it meets it
The free plan includes the processing inventory and DPIA pre-assessments. Full DPIAs, the breach register (reported and unreported incidents), requests and vendor risk are modules on its paid plans. Client data is processed in the Netherlands.
Check with the vendor
Its Pro plan names one extra module as included. Confirm how many of the four you get before you choose it.
Vanta
What it is
A security compliance platform whose frameworks include SOC 2, ISO 27001 and GDPR.
Who it fits
A software firm already using it, or about to, for a security audit that wants its GDPR records in the same place.
What the rule requires and whether it meets it
Its GDPR page covers a live data inventory, the record of processing and DPIAs. Its vendor product reads processors’ DPAs, and its plans include security awareness training.
Check with the vendor
The pages we read do not describe a request log, a personal data breach log or where data is hosted. Ask how those rows are handled before you rely on it alone.
How we compared them
We started from suites sold to small and mid-sized firms that cover the GDPR’s record-keeping articles in one product: suites that come with a data protection officer service, self-serve registers, and a security compliance platform with a GDPR framework. Platforms that cover the US state laws as much as the GDPR are compared on our privacy management software page, and enterprise suites on our OneTrust alternatives page.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Does a business with fewer than 250 employees need a record of processing?
Art. 30(5) lifts the duty for firms under 250 people only when the processing is occasional, unlikely to be a risk to people, and does not include special categories of data or criminal records. Regular processing such as payroll or a customer list is hard to call occasional, so most small firms keep a record for at least those activities.
How long do I have to answer a data subject request?
One month from receipt, under Art. 12(3). It can be extended by two further months where the requests are complex or numerous, but you must tell the person about the extension, and why, within the first month.
Do I have to log a breach I decide not to report?
Yes. Art. 33(5) asks the controller to document any personal data breach: the facts, its effects and the remedial action taken. The log is how you show an authority why a breach did not need to be notified.
Is a spreadsheet enough instead of GDPR software?
For the form, yes: Art. 30(3) only asks that the record be in writing, including in electronic form. The case for software is keeping five linked files current, with reminders on the deadlines, once more than one person touches them.
Does GDPR software make my business compliant?
No tool does that on its own. The software holds the record, the assessments and the logs; whether they are accurate, and whether you act on them, is still your work. Our GDPR checklist, linked above and under Related, shows which parts of the regulation a small firm needs to cover.
We are a US company with EU customers. Do these tools apply to us?
If the GDPR reaches you, the same five files apply. Whether it does depends on whether you offer goods or services to people in the EU or monitor their behaviour there; our guide to whether GDPR applies to US companies covers the test.