Which GDPR compliance software should a small business pick in 2026?
Most small businesses need two things, not one: a record of what data they process, and a consent banner on their website. Here is what each costs.
A European customer sends you a vendor questionnaire asking for your record of processing activities. Your marketing team wants Google Ads to keep working in the EU. Your lawyer mentions a data processing agreement. GDPR (the EU's data protection law) applies to you as soon as you handle data about people in Europe, wherever your company is based.
The short answer: to keep your records, impact assessments and data requests in one place, start with Witik, whose Starter plan is free. If you want a person to guide you, Data Comply One starts at €190 a month and works in English. Legiscope suits a group of several companies. For your website, Termly ($10 a month billed yearly), Axeptio and iubenda handle the cookie banner and privacy policy, which a records tool does not.
One warning first: no software makes you compliant. It organizes, reminds and proves. The decisions are still yours.
The ranking is editorial: a sponsored placement is always labeled on its card, and no affiliate link ever changes a score.
The best GDPR software by need
The 6 best GDPR tools for small business compared
The full ranking. The "first-year cost" column puts every entry plan on the same footing, before tax, with the contract length the vendor requires. Records tools and website consent tools solve different problems, so most small businesses end up with one of each.
| Best for | First-year cost, entry plan | Free plan | Team size | Visit | ||||
|---|---|---|---|---|---|---|---|---|
| 1 | Witik | Best free records tool | €0 on Starter; from €2,880 on Premium | 4.3/5 | Free, Premium from €240/month | ✓ | Teams that run GDPR in-house | Visit → |
| 2 | Data Comply One | Best software with a coach | €2,280 on Solo; €3,480 with an outsourced DPO | 4.2/5 | From €190/month | — | Up to 100 employees | Visit → |
| 3 | Legiscope | Best for several companies | €1,500 on Essentiel; €2,500 with automated DPIA | 3.8/5 | From €1,500/year | — | Holding or group of companies | Visit → |
| 4 | Termly | Best all-round website consent tool | $0 on Free; $120 on Starter | 3.7/5 | Free, then $10/month billed yearly | ✓ | Any small business website | Visit → |
| 5 | Axeptio | Best simple cookie banner | $0 under 200 visitors; $90 on Extra Small | 3.7/5 | Free, then $7.50/month billed yearly | ✓ | Low-traffic sites | Visit → |
| 6 | iubenda | Best for generated legal policies | $71.88 on Essentials | 3.6/5 | From $5.99/site/month billed yearly | ✓ | Sites that need policies in many languages | Visit → |
Prices before tax, read on each vendor's official pricing page in 2026. Witik quotes its paid plan for a 36-month commitment.
Is your tool missing from this page? Email us: hello@hackceleration.com
How we compared and scored
Most of the pages ranking for this search are written by vendors: a consent platform, a cookie banner company and a records software publisher each rank their own category first. None of them separates the two jobs a small business actually has, and none puts prices on a common time frame.
We read each vendor's official pricing page and terms, the guidance of the French and UK regulators, and user reviews on G2, Capterra and forums. Our reader: a business of 1 to 100 people with no in-house lawyer, often outside the EU, that sells to European customers or tracks European visitors.
Several known names are left out. Dastra, Leto and Adequacy publish no prices, and we don't rank a tool when we can't tell you what it costs. Vanta and similar security platforms target SOC 2 audits for software companies, a different purchase.
GDPR coverage weighs the most, because a cookie banner alone covers only a slice of the law. That's also why the three consent tools score lower overall, even though they do their own job well.
- GDPR coverageRecords of processing, impact assessments (DPIA), data subject requests, breaches, consent.30%
- Price and contractPublic price, commitment length, first-year and three-year cost.25%
- Ease of useTemplates, guided questionnaires, usable without a lawyer.20%
- Human supportCoaching, appointed DPO, help during a regulator inquiry.15%
- Hosting and securityWhere data is hosted, stated certifications, transfers outside the EU.10%
No affiliate link changes a score or a rank.
Witik
Witik is a French platform and the only tool in this ranking that covers the whole GDPR cycle on a free plan with no time limit. Starter gives you a record of processing activities (the Article 30 register every company must keep) with up to 30 items, two impact assessments, two audits, ten data subject requests and ten incidents a year, plus an action plan. A twenty-person company starting out can live on it for a while.
Premium lifts every limit and adds custom forms, an AI assistant, dashboards and multi-entity management, from €240 a month. Read the small print: that price assumes a 36-month commitment paid yearly. Shorter terms or monthly billing cost more, and the extra isn't published. Over three years, budget at least €8,640.
Witik says its data is hosted in France on infrastructure certified ISO 27001 and HDS (the French health data hosting certification), with nothing leaving the EU. If your European customers ask where your compliance data lives, that answer is easy.
User reviews call it simple to use day to day, but there are few of them, and the add-ons (training, vendor assessments, cookies) carry no public price. Check that the interface language suits your team during the 14-day trial.
Tip: fill in Starter for a couple of months before you talk to sales. You'll know whether you really need more than 30 items, and you'll negotiate the commitment with numbers in hand.
- Free plan with no time limit
- Hosted in France, ISO 27001 and HDS
- 14-day Premium trial
- ✓Records, DPIA, requests and incidents on the free plan
- ✓Usable without a lawyer
- ✓Fits health data
- ✗Premium price assumes 36 months
- ✗Add-ons without public prices
- ✗Few public reviews
The best place to start if you run GDPR yourself. If a three-year contract is a deal-breaker, Data Comply One commits for 12 months.
Data Comply One
Data Comply One is built by Mission RGPD, a company based in Lyon, France. It runs in six languages, including English, Spanish and German, which matters if your team isn't French-speaking. The price grid has three tiers. Solo, from €190 a month, gives you the software with unlimited users and dedicated support. Coach, from €230, adds personal coaching by a DPO (data protection officer). Externalisé, from €290, appoints an outsourced DPO for you, files the declaration with the French regulator and supports you during an inquiry.
The commitment is 12 months, and paying yearly takes off 15%. Solo costs €2,280 in year one on monthly billing, about €1,940 paid upfront. With the outsourced DPO, plan €3,480 a year.
It also covers the EU AI Act, NIS 2 (the EU cybersecurity directive) and DORA, so one platform can grow with new regulations.
The limits: prices are "from" figures that rise with company size, and above 100 employees it's a quote. The pricing page shows two different prices for the e-learning add-on (€95 and €130 a month), so ask which applies. Detailed user reviews are scarce.
Tip: if your EU representative or lead customer asks who your DPO is, the €290 tier answers that question with a name.
- Three public price tiers
- Outsourced DPO from €290
- Six languages, AI Act and NIS 2 included
- ✓12-month commitment only
- ✓Unlimited users
- ✓Support during a regulator inquiry
- ✗"From" prices rise with headcount
- ✗Quote above 100 employees
- ✗Few detailed reviews
The best balance of software and human help on a short contract. If you only need records and no budget, Witik's free plan does it.
Legiscope
Legiscope prices by organizations managed, not by user. Essentiel at €1,500 a year covers 10 organizations and up to 100 users; Pro at €2,500 covers 20. For a group of five companies, that's the lowest cost per entity in this ranking. Payment is yearly and upfront, with a 12-month term.
The software uses AI agents to pre-fill your records and documents from the files you upload. Each plan includes a contractual number of AI tokens (75,000 on Essentiel, 200,000 on Pro), and the vendor itself says you can't predict usage in advance: it depends on the size of the documents processed. Automated impact assessments start on Pro.
Worth knowing: Legiscope publishes a lot of content about choosing GDPR software, including pages that rank for this search, and those comparisons don't show its own prices. There's no free trial, only a demo.
Tip: with a single company, Essentiel pays for nine entities you won't use. Witik or Data Comply One fit a single business better.
- Priced per organization
- Up to 100 users from Essentiel
- AI-drafted documentation
- ✓Cheapest per entity for a group
- ✓Five public tiers
- ✓12-month term
- ✗Automated DPIA only from €2,500
- ✗AI token use is hard to predict
- ✗No free trial
The logical pick for several companies under one roof. For a single small business it's oversized.
Termly
Termly handles the website side of GDPR: a cookie consent banner, generated privacy and cookie policies, and a form for data subject access requests (DSAR, when someone asks for a copy of their data). That form is on every plan, which is rare among consent tools.
The free plan covers one site, one user, one basic policy and 10,000 banner views a month, with quarterly cookie scans. Starter, at $10 a month billed yearly ($14 monthly), raises that to 50,000 views and two policies, adds monthly scans and stores data in the EU. Pro+, at $15 yearly ($20 monthly), removes the view limit and adds Google Consent Mode v2, IAB TCF 2.3 (the ad industry's consent standard) and consent logs.
Watch the plan line-up: Google Consent Mode v2 and consent logs are listed on Pro+, not Starter. If you run Google Ads to European visitors, budget $180 a year rather than $120.
Termly doesn't keep your record of processing activities or run impact assessments. Pair it with a records tool or a spreadsheet.
- Request form on every plan
- Free plan with 10,000 banner views
- 30-day money-back guarantee
- ✓Clear prices in dollars
- ✓Policies kept up to date
- ✓EU data storage from Starter
- ✗Consent Mode v2 only on Pro+
- ✗No records of processing
- ✗Starter capped at 50,000 views
The most complete website consent tool for the price. Add a records tool next to it; it doesn't replace one.
Axeptio
Axeptio is a French consent banner known for its friendly design. Its free plan covers one domain and 200 visitors a month, with consent storage and Google Consent Mode v2 included. Extra Small costs $90 a year for up to 2,500 page views a month. The cookie scanner and TCF support arrive on Small, at $29 a month or $313 a year.
It does one job. No records of processing, no impact assessments, no request handling. Many small businesses buy it believing it covers GDPR; it covers cookies.
The trap is the page-view meter: a site above 2,500 views a month moves to Small, and a store at 100,000 views needs Medium at $745 a year. Third-party sites quote conflicting Axeptio prices; trust the official page.
Tip: size your plan on your busiest month, not your average.
- Free under 200 visitors
- Consent Mode v2 on the free plan
- Consent records included
- ✓Set up in minutes
- ✓Readable tiers
- ✓About 10% off yearly
- ✗Cookies only
- ✗Scanner from $29 a month
- ✗Tiers jump with traffic
A good banner for a small site. Above a few thousand views a month, Termly gives more for less.
iubenda
iubenda started as a privacy policy generator and still shines there: it writes and updates your privacy and cookie policies from a list of the services your site uses. Essentials, at $5.99 per site a month billed yearly, includes up to 25,000 page views and one language. Advanced, at $24.99, adds terms and conditions, all languages and geo-targeting. Ultimate, at $99.99, removes branding and adds hourly scans.
Costs climb in two ways. Extra page views are billed per 1,000 above your plan. And storing consents from forms and newsletter sign-ups is an add-on, priced per 1,000 consents. Reviewers on G2 and Capterra say it can get pricey once you stack products, and that the generated wording can feel generic unless you edit it.
Like Termly and Axeptio, it doesn't keep your record of processing activities.
Tip: if you only sell in English, Essentials does the job; you need Advanced the day you add a second language.
- Policies generated and updated
- From $5.99 a month billed yearly
- 14-day refund
- ✓Policies in many languages
- ✓Free plan to start
- ✓Plugins for common site builders
- ✗Per-site pricing adds up
- ✗Form consents cost extra
- ✗Generic wording to edit
The pick when legal documents are the priority. For the banner alone, Termly or Axeptio are simpler.
What GDPR software really costs, and what it won't do
Two different products share the "GDPR software" label. A records tool documents what your company does with personal data. A consent tool manages cookies and policies on your website. Most small businesses need both, and some also need an outsourced DPO.
Three-year cost, entry plans
Contract length matters as much as price
What software never does
- List your processing activities in a spreadsheet before any demo; the French regulator's free template is a good base.
- Check whether you must appoint a DPO (large-scale sensitive data, regular monitoring of people).
- Check whether you need an EU representative, if you have no office in the EU.
- Note your monthly page views on your busiest month before picking a consent tool.
- Ask for the exact commitment length and the price of a shorter one.
- Demand an export of your records in an open format.
Six steps to roll out GDPR software without drowning
Half-filled records are the most common outcome. This order works in a small team with no lawyer.
Map your processing activities
Week 1List what you do with personal data: payroll, hiring, customers, prospecting, website analytics, support tickets. Each one is a line in your record. The count tells you whether a spreadsheet is enough.
- Required by
- Article 30 GDPR
Name an internal owner
TeamEven with an outsourced DPO, someone inside must answer questions and keep the tool current. Without that person, the best software stays empty.
- Starting effort
- 1 hour a week
Collect your vendor agreements
ContractsYour CRM, payroll, hosting and email tools process data for you. Each needs a data processing agreement under Article 28. European customers often ask for this list first.
- Required by
- Article 28 GDPR
Fix your website consent
WebsiteInstall the banner, block non-essential scripts until consent, and check that your analytics and ads respect the visitor's choice. Run a cookie scan after every new plugin.
- Rescan
- After each new tool
Prepare for data requests
DeadlineAnyone can ask for a copy or deletion of their data. You have one month to answer. Set up a dedicated inbox or form and a reply template before the first request lands.
- Response time
- 1 month
Write your breach procedure
UrgentA stolen laptop or an email to the wrong person can be a personal data breach. When it creates a risk, you must notify the regulator within 72 hours. Keep a log of every incident, even those you don't report.
- Notification
- 72 hours
GDPR is in motion, now what
Privacy also depends on the tools your team uses every day.
Security compliance platforms.
Many breaches start with an infected laptopBest antivirus and EDR for businessProtect the devices that hold your data.
Your data processing agreements live in inboxesBest contract management software for small businessFind every Article 28 clause fast.
Payroll and hiring hold your most sensitive dataBest HRIS for small businessEmployee records in one controlled place.
Customer files are scattered across drivesBest document management for small businessAccess rights and retention periods.
You want to know where your site data is hostedBest web hosting for small businessThe server behind your forms.
GDPR software for small business · FAQ
Does GDPR apply to a small business outside the EU?
Yes, if you offer goods or services to people in the EU or monitor their behavior, for example with analytics or ad tracking on your website. Company size and location don't exempt you. Without an EU office, you may also need to appoint an EU representative.Do businesses with fewer than 250 employees need a record of processing?
In practice, yes. The exemption only covers occasional processing. Payroll, customer data and anything risky or sensitive must be recorded, so almost every company with staff or customers needs one.Is there free GDPR compliance software?
Yes. Witik's Starter plan covers records, impact assessments, requests and incidents within fixed limits, with no time limit. The French regulator publishes a free register template and an open-source DPIA tool, and Termly, Axeptio and iubenda have free consent plans.How much does GDPR software cost a small business?
From $0 to about €3,500 in year one for the entry plans in this ranking. Records tools run from free (Witik) to €1,500 a year (Legiscope) or €190 a month (Data Comply One). A consent banner adds $0 to about $180 a year for a typical small site.Is a cookie banner enough for GDPR compliance?
No. It covers consent for trackers on your website, not your payroll, hiring, customer list or vendor contracts. You still need a record of processing and a way to answer data requests.Do I need a DPO for a small business?
Only if your core activity involves large-scale regular monitoring of people or large-scale processing of sensitive data such as health. Otherwise it's optional. Data Comply One's Externalisé tier includes an outsourced DPO from €290 a month.What's the difference between GDPR software and a consent management platform?
A consent management platform (CMP) runs the cookie banner and stores proof of consent. GDPR compliance software keeps your records, impact assessments, requests and breaches. Termly blurs the line slightly with a request form on every plan, but it doesn't keep records.Can I keep my record of processing in a spreadsheet?
Yes. Article 30 requires a record, not a specific tool, and the French regulator publishes a free spreadsheet template for small organizations. A spreadsheet starts to fail when several people edit it, when you pass a few dozen activities, or when customers ask for proof of updates; that is when Witik's free plan is worth a look.Is a letter demanding payment for GDPR compliance a scam?
Often, yes. French authorities and professional bodies have warned about companies that pressure small businesses with official-looking letters selling so-called mandatory compliance. Regulators don't sell services or require a specific provider. Never pay on the basis of an unsolicited letter.