GDPR compliance software: GDPR management software for US companies of 5 to 200 selling into the EU

GDPR compliance software is a system that holds the records, controls, contracts, and deadlines the General Data Protection Regulation requires, with an owner against each one. In practice that means a record of processing activities under Article 30, the security measures under Article 32 with evidence that they run, the processor contracts under Article 28, and the notification clocks under Articles 33 and 12. It replaces a spreadsheet and a shared drive with something you can hand to an auditor or an enterprise customer.

Yes, if Article 3(2) applies. A US company with no office or staff in Europe is still in scope when it offers goods or services to people in the EU, or monitors their behaviour. Accepting euros, shipping to EU addresses, running an EU language site aimed at that market, or running analytics and retargeting that observe EU visitors are each enough. Physical location does not decide it and intent does not excuse it.

Almost certainly yes. GDPR sets no minimum number of data subjects and no revenue threshold for the regulation to apply. A handful of EU customers puts you in scope. What volume changes is the depth of what is proportionate: a company with twelve EU users runs a much smaller program than one with twelve thousand, but the obligations exist either way and the Article 32 security duty does not scale away.

It depends which of the three problems you have. If you need a lawful cookie banner and a privacy policy, a consent tool like iubenda or Osano is the right purchase and both publish prices. If you need to show enterprise customers evidenced security controls and a current processing record, a compliance platform is the right purchase. If you need data discovery across a sprawling estate, you need a privacy suite and the budget that comes with it. Buying the wrong one of the three is the most common and most expensive mistake in this category.

It ranges from a few dollars a month to five and six figures a year, because the label covers three different products. Consent tools publish low self-serve prices: iubenda lists $5.99 to $99.99 a month billed yearly, and Osano lists a free consent tier and $199 a month for its Plus consent plan. Compliance platforms with GDPR as one framework run from $79 a month at the small end to quote-only annual contracts, where Vendr benchmark data puts Vanta around a $20,000 median and Drata around $24,868. Enterprise privacy suites like OneTrust and TrustArc publish no figures at all.

Usually yes, despite the exemption. Article 30(5) exempts organisations with fewer than 250 employees, but only when the processing is occasional, is unlikely to result in a risk to the rights and freedoms of data subjects, and involves no special category data under Article 9(1) or criminal conviction data under Article 10. A SaaS company processing customer data continuously is not doing it occasionally, so the exemption fails on the first condition. Most small companies that believe they are exempt are not.

Article 32 requires security appropriate to the risk and names specific measures to consider: pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore access after an incident, and a process for regularly testing and evaluating the effectiveness of the measures. It deliberately does not publish a control list, so the practical approach is to map it onto a framework you already run, such as the SOC 2 common criteria or the ISO 27001 Annex A controls, and evidence those.

If you are a controller or processor not established in the EU but caught by Article 3(2), yes, unless an exception applies. Article 27(2) removes the requirement where the processing is occasional, does not include large scale special category or criminal conviction data, and is unlikely to result in a risk to people, or where you are a public authority. A representative is a designated contact in a member state where your data subjects are, named in your privacy notice. Complies tracks that you have appointed one; it does not act as one.

Yes, under a valid mechanism. The European Commission adopted an adequacy decision for the EU-US Data Privacy Framework in July 2023, and the EU General Court upheld it in September 2025 in the Latombe case. An appeal is pending, so treat the mechanism as something you review rather than settle once. Companies not certified under the framework generally rely on standard contractual clauses with a transfer impact assessment behind them. Record which mechanism each transfer uses in the processing record, because that is the question you will be asked.

There is no single official GDPR certificate the way people expect. Articles 42 and 43 provide for certification mechanisms approved by supervisory authorities or the European Data Protection Board, and a small number exist, but none is a general purpose GDPR stamp and none makes you compliant by itself. Article 42(4) says explicitly that certification does not reduce the responsibility of the controller or processor. In practice, US buyers ask for a SOC 2 report or an ISO 27001 certificate plus your DPA, not a GDPR certificate.

No, but it covers a large part of the security half. Article 32 is about security of processing, and the SOC 2 common criteria and the ISO 27001 Annex A controls satisfy most of what it asks for, which is why cross-mapping saves real work. What neither covers is the rest of GDPR: lawful basis, transparency and privacy notices, data subject rights, retention limits, international transfers, and the processing record itself. Treat SOC 2 or ISO 27001 as a running start on Article 32 and nothing more.

A consent management platform handles the banner on your website: it collects, stores, and proves consent for cookies and trackers, and it usually generates the cookie and privacy policies. GDPR compliance software handles everything behind the website: the processing record, the security controls and their evidence, the processor contracts, the retention rules, and the deadlines. They solve different halves of the regulation, and most US SaaS companies selling into the EU end up running one of each rather than choosing between them.