Privacy management software
For a small firm with customers in both the EU and the US that wants requests, records, assessments, vendor reviews and consent in one place. 7 whole-program platforms, measured against what the GDPR and the California law ask a privacy program to produce, from each vendor’s own pages. read 2026-10-22
Best overall for a small privacy team
Osano
Its own plans page lists every row but the breach register, and you can start on a self-service plan.
Best for starting with the banner
Ketch
A free consent plan that honors GPC, with requests, mapping and assessments added on the same platform later.
Best when requests are the heaviest load
DataGrail
Identity checks against data you already hold, and a live data map that finds where each person's data sits.
The program's requirements, platform by platform
Each row is something the GDPR or the California rules ask a privacy program to do, with the article or section beside it. Read across for one requirement; read down for one platform. “paid plan” here usually means a higher tier or a module sold on its own, so check what your quote includes. If you have not mapped your data yet, our data mapping software comparison (under Related) covers that module on its own.
| Requirement | Osano | TrustArc | OneTrust | DataGrail | Ketch | Secure Privacy | DataGuard |
|---|---|---|---|---|---|---|---|
| Keeps a record of processing activitiesGDPR Art. 30(1) | paid planquoted module | yes | yesactivity map | yesCSV or PDF | paid planPro plan | yes | yes |
| Finds personal data in your systems on its ownthe inventory behind Art. 30(1)(c) | paid planquoted module | partialvia partner tools | yes | yes | paid planPro plan | not statedmapping add-on | partialasset import |
| Takes rights requests and tracks the response clockGDPR Art. 12(3); Cal. Civ. Code § 1798.130(a)(2) | paid planfrom Basic Privacy | yes | yesSuite package | yesdeadline alerts | paid planPro or add-on | paid planBusiness plan | yes |
| Checks the requester is who they sayGDPR Art. 12(6); CCPA regs § 7060 | paid plansubject rights module | yes | yes | yes | paid planAuthenticatedID | not stated | not stated |
| Runs impact and risk assessmentsGDPR Art. 35(1); CCPA regs § 7150 | paid planGDPR DPIA, quoted | yesGDPR and CCPA | yesGDPR DPIA | yesGDPR DPIA | paid planCCPA named | yesCPRA packs | yesGDPR DPIA |
| Assesses vendors before they get your dataGDPR Art. 28(1); § 1798.100(d) | paid planquoted module | yes | yes | yes | paid planvendor reviews, Pro | paid plangovernance plan | yes |
| Runs a banner that honors Global Privacy ControlePrivacy Art. 5(3); CCPA regs § 7025 | yes | yes | yes | yes | yesfree plan | not stated | not stated |
| Keeps a register of personal data breachesGDPR Art. 33(5) | not stated | not stated | yes | not stated | not stated | not stated | yes |
| Publishes a data processing agreementGDPR Art. 28(3) | yes | yes | yes | yes | yes | yes | not stated |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | |||||||
What the program has to hand over, and when
A privacy platform earns its keep by producing documents on demand. These six are the ones the GDPR and the California law ask for by name. When you take a demo, ask the vendor to show each one coming out of the tool, filled in. A blank in one column means that law has no matching clause, not that the work is optional: other laws, California’s included, can still ask for it.
| What you must produce | GDPR | California (CCPA) |
|---|---|---|
| An answer to a rights request | One month from receipt; two more months where needed, if you tell the person within the first monthArt. 12(3) | 45 days from receipt; once more by 45 days, if you give notice inside the first 45§ 1798.130(a)(2) |
| A log of every request | no matching article | Kept at least 24 months: date, type, how it came in, when and how you answered, and why any denialregs § 7101 |
| A record of processing activities | In writing (electronic counts), and handed to the supervisory authority on requestArt. 30(1), (3), (4) | not in the CCPA |
| An impact or risk assessment | Before processing likely to result in a high riskArt. 35(1) | Before selling or sharing data, using sensitive data and the other listed activities; reviewed at least every three years, updated within 45 days of a material change, kept for as long as the processing continues or five years after completion, whichever is laterregs §§ 7150, 7155 |
| A breach record | Every breach documented; the authority told within 72 hours where feasible, unless the breach is unlikely to result in a riskArt. 33(1), (5) | not in the CCPA |
| A contract with each vendor | A processing contract with the terms the article listsArt. 28(3) | An agreement limiting the vendor to specified purposes§ 1798.100(d) |
Source: the GDPR, the California statute and the CCPA regulations, read 2026-10-22. | ||
The request clock is where small firms slip first, because it starts when the request arrives, not when someone notices it. Our DSAR deadline calculator gives the dates for one request; a platform keeps them for all of them. If customers in other states write to you, their own laws apply too: our state-by-state guide covers them.
Under the California rules, processing that began before January 1, 2026 and still runs needs its risk assessment done by December 31, 2027 (regs § 7155(b)). What you report about the assessments made in 2026 and 2027 is due to the agency by April 1, 2028 (§ 7157(a)(1)).
Rule texts: GDPR, California statute, CCPA regulations.
Does a 30-person firm need a whole platform?
Most of these platforms were built for companies with a privacy team. A small firm buys one for a narrower reason: the clocks and records above have started to slip in email and spreadsheets. Two questions settle it.
Do you have to keep the records at all?
The GDPR’s record of processing comes with a small-business carve-out, and it is narrower than it looks.
“The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data …”
Any one of the three conditions brings the record back. Payroll, a customer list or a newsletter run every week is hard to call occasional, so many small firms that touch EU personal data keep one anyway. Our guide to data mapping shows what goes into it, and the data map template builds a first version without any software.
Where does the spreadsheet stop working?
A spreadsheet can hold a record of processing and a vendor list for a long time. It is weakest at the things that move: request deadlines, proof of who asked and when, and a banner that has to react to a browser signal. Those are the modules worth paying for first.
- Banner and opt-out signals. Your website is the one part of the program anyone can test from outside, regulators included. Our consent platform comparison, linked in the method notes below, covers banner-only tools if that is all you need for now.
- Request intake with the clock and the log. The one-month and 45-day deadlines and the 24-month log are hard to keep by hand. If requests are your whole problem, our DSAR tools comparison, also linked in the method notes below, is built for a firm without a privacy team.
- Records of processing and the data map. Buy discovery when your systems outgrow what one person can list from memory.
- Assessments. Start from our privacy impact assessment template (under Related) and move into a platform when you run more than a few a year.
- Vendor reviews and the breach register. Only two platforms in the table describe a breach workflow, so if you need one, it may decide the shortlist on its own.
Not sure which laws reach you in the first place? The which-laws tool answers that in a few questions.
Each platform in short
What each one is, who it fits, how it meets the rows, and what to confirm with the vendor before you sign. Two of these are compared head to head on our Osano vs OneTrust page.
Osano
What it is
One account with six products: cookie consent, subject rights, data mapping, assessments, vendor risk management, and a hub for consent and marketing preferences.
Who it fits
A firm where one or two people run privacy and want every module from one vendor. It offers self-service plans and a free 30-day trial, so you can start before a sales call.
What the rule requires and whether it meets it
Its plans page lists automatic deadline calculation for requests, multi-factor identity checks, Article 30 records filled from its own data discovery, DPIA templates, vendor risk scores and a banner that honors GPC. Its processing addendum is on its trust hub.
Check with the vendor
Its self-service plans are consent plans: request intake starts at Basic Privacy, and mapping, assessments and vendor risk come by consultation. We found no breach register. Its “No Fines, No Penalties” guarantee is a contract term, so read its conditions before you count on it.
TrustArc
What it is
Two product lines. Privacy Studio holds the cookie banner, consent and preferences, and the Individual Rights Manager. The Governance Suite holds PrivacyCentral, data mapping, assessments and Nymity legal research.
Who it fits
A firm that wants the law-by-law work done inside the tool. Its own page says PrivacyCentral suits multinationals with a dedicated privacy function, so a 30-person firm should ask which products it can buy on their own.
What the rule requires and whether it meets it
Due dates and extensions set by jurisdiction, identity checks scaled to the request, Article 30 reports for controllers and processors, ready-made DPIA, vendor and transfer assessments, and a banner that supports GPC.
Check with the vendor
Its data discovery draws on integrations and partner tools rather than a scanner of its own. The pages we read show no breach register and no self-service plan.
OneTrust
What it is
The widest suite here, sold as packages. Privacy Automation Base covers the data map, impact assessments, vendor risk and DPAs; the Suite package adds data subject requests. Consent is sold as its own packages.
Who it fits
A firm that expects to grow into a full privacy, third-party risk and AI governance program, and has someone whose job is to run it.
What the rule requires and whether it meets it
It is one of two platforms here whose pages describe a privacy incident workflow, including guidance on when notification is required. Requests come with identity checks and redaction, and GPC is set in its consent product.
Check with the vendor
Pricing is quoted on admin users and the size of your inventory, so cost grows with the map. Requests need the Suite package, not Base, and the pages we read do not show how the deadline clock is tracked. Lighter options are on our OneTrust alternatives page.
DataGrail
What it is
A platform built around a live data map: request handling, data discovery, records of processing, risk assessments and a consent banner.
Who it fits
A firm that gets a steady flow of access, deletion and opt-out requests, with customer data spread across many software tools.
What the rule requires and whether it meets it
Its Smart Verification checks identity against data you already hold. Records of processing export as CSV or PDF, and assessments cover PIAs, DPIAs and transfer assessments. Its own blog describes how it recognizes GPC, and its processing addendum is published.
Check with the vendor
Its DSAR page promises alerts before legal deadlines; ask to see how the one-month and 45-day clocks show in the dashboard. We found no breach register.
Ketch
What it is
A consent-first platform. Its free plan is a full consent manager for up to 5,000 unique users a month. Request handling, data mapping and risk assessments are sold separately on its Pro plan, with a rights add-on on Plus.
Who it fits
A firm that needs a banner now and will add request handling later, especially one whose customers log in across several devices.
What the rule requires and whether it meets it
Every plan honors GPC. On Pro, its AuthenticatedID check scales identity checks to the request type and jurisdiction, its map produces records of processing, and its assessment workflows name the CCPA risk assessment.
Check with the vendor
It publishes a data processing addendum, but we found no breach register on its site, so ask how incidents are logged. Its pricing page pitches Pro at mid-market and larger brands, so ask what the request module means for a smaller firm.
Secure Privacy
What it is
A Danish consent platform with a separate Privacy Governance line: request management, Article 30 records, DPIAs and vendor assessments.
Who it fits
A small firm that starts on a free banner plan and wants to add requests and records from the same vendor.
What the rule requires and whether it meets it
Automatic cookie blocking starts on its first paid plan and request forms on the Business plan. It keeps Article 30 records, offers DPIA templates with CPRA packs, and publishes a DPA as part of its terms.
Check with the vendor
The pages we read do not mention GPC, identity checks or deadline tracking for requests. Data mapping and vendor risk are add-ons on the consent plans. Ask before you rely on it for California visitors.
DataGuard
What it is
A European security and compliance platform. Its privacy modules cover data mapping and records of processing, data subject requests, DPIAs, vendor risk, incident and breach management, and consent.
Who it fits
An EU-first firm where the same person handles privacy and information security. Its Pro plan includes hands-on support from its in-house experts.
What the rule requires and whether it meets it
It is the other platform here with a breach workflow: guided prompts collect the facts and the records stay for audits. Request deadlines sit in one view, with DPIA templates and a vendor inventory beside them.
Check with the vendor
The pages we read do not mention the US state laws, GPC, identity checks or a published processing agreement. If you have California customers, confirm US coverage first.
How we compared them
We picked platforms that sell requests, records of processing, assessments and consent under one account: the two large suites, four platforms that market to smaller teams, and one European security and privacy platform whose pages do not mention the US state laws, kept in for firms led from the EU. Single-module tools are compared on their own pages, such as consent platforms and DSAR tools.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
What is the difference between privacy management software and a consent management platform?
A consent platform runs the cookie banner and records each visitor’s choice. Privacy management software covers the rest of the program as well: rights requests, the record of processing, assessments, vendor reviews and, on some platforms, breaches. Several vendors sell both, often as separate products on one account.
Does one platform cover both the GDPR and the US state laws?
Most of the platforms here say they do, but read the table row by row. The request clock differs (one month under GDPR Art. 12(3), 45 days under § 1798.130 of the California law), and California asks for a request log kept at least 24 months (regs § 7101). Check that the tool sets the right clock for each requester’s location.
Can a platform verify identity for every kind of request?
It should not try to. The CCPA regulations say a business must not require identity verification for a request to opt out of sale or sharing (§ 7060(b)), while access, deletion and correction requests need a reasonable method. A good tool lets you set the check per request type.
Is privacy management software the same as having a DPO?
No. Software keeps the records and the clocks; it does not give the advice or take the accountability. If the GDPR requires you to appoint a data protection officer, our outsourced DPO services page compares the options.
Does the platform need its own data processing agreement?
Yes, in most cases. A privacy platform holds some of your most sensitive data, including the identity documents people send with requests, so under GDPR Art. 28(3) it is a processor that needs a contract. Our data processing agreement template lists what that contract has to say.