Contents
The five German data protection tools compared here are fuentis, DataGuard, Proliance 360, heyData and caralegal. They cover GDPR accountability obligations to varying degrees, from the record of processing activities (RoPA) to personal data breach notification. According to Bitkom, documenting processing activities is the most cited data protection burden: 84 percent of companies name it, up from 73 percent a year earlier.
The selection is editorial, the order is not a ranking, and fuentis is the vendor of one tool. Criteria: headquarters in Germany per the legal notice, and data protection management software with a RoPA function on the official vendor website. All information on the other vendors comes from their websites, as of October 2026. No software makes a company GDPR-compliant; responsibility stays with the controller.
What Must Data Protection Software Deliver?
Data protection software (also GDPR software) should cover the GDPR's accountability obligations: the record of processing activities under Art. 30, technical and organisational measures (TOMs) under Art. 32, processors under Art. 28, personal data breaches under Art. 33 and Art. 34, data protection impact assessments (DPIAs) under Art. 35 and data subject requests. The GDPR requires evidence, not a particular piece of software.
| Obligation | GDPR article | Deadline or trigger |
|---|---|---|
| Record of processing activities (RoPA) | Art. 30 | ongoing; exemption below 250 employees only within narrow limits (para. 5) |
| Technical and organisational measures (TOMs) | Art. 32 | ongoing, appropriate to the risk |
| Contract with processors | Art. 28(3) | contract or other legal act, no deadline |
| Notification of personal data breaches | Art. 33 and 34 | supervisory authority without undue delay, where feasible within 72 hours; data subjects without undue delay if the risk is high |
| Data protection impact assessment (DPIA) | Art. 35 | in advance, where a high risk is likely |
| Data subject rights (access, erasure, etc.) | Art. 12 to 22 | one month, extendable by two months (Art. 12(3)) |
The RoPA is the starting point, not the full evidence. The German Data Protection Conference (DSK) states in its Kurzpapier Nr. 1: "The record is only one building block for meeting the accountability obligation set out in Art. 5(2)." (translated)
Supervisory practice shows how tight 72 hours are: per its activity report, the Bavarian Data Protection Authority (BayLDA) received 3,603 data breach notifications in 2025, 23 percent more than the previous year. Whoever identifies the affected processing activities and systems only during the incident spends the deadline searching.
Not every organisation needs a tool. Small companies with few low-risk processing activities often manage with templates. Software pays off when several group companies, many service providers (third-party risk management) or recurring requests need managing.
Which Data Protection Tools from Germany Are There?
DataGuard, Proliance 360, heyData and caralegal list modules for the RoPA, DPIAs and data subject requests on their websites. The fuentis DPMS documents the RoPA, TOMs, processors and personal data breaches with 72-hour deadline calculation; the product page says nothing on DPIAs or data subject requests. The table reflects vendor claims.
| Module (GDPR) | fuentis | DataGuard | Proliance 360 | heyData | caralegal |
|---|---|---|---|---|---|
| RoPA (Art. 30) | yes | yes | yes | yes | yes |
| TOMs (Art. 32) | yes | not stated | yes | yes | yes |
| Processors, DPAs (Art. 28) | yes | partly (processors in third-party risk management) | yes | yes | yes |
| Personal data breaches (Art. 33/34) | yes, with 72-hour deadline calculation | yes | yes | yes | yes |
| DPIA (Art. 35) | not stated | yes | yes | yes | yes |
| Data subject requests (Art. 12 to 22) | not stated | yes | yes | yes | yes |
| Training | not stated | yes | yes | yes | yes |
| Hosting | Germany (SaaS); private cloud or on-premise possible (Enterprise) | not stated on dataguard.de | servers in Europe | Germany | Germany (Frankfurt) |
| Public pricing | Suite yes, DPMS not listed | no | yes | yes | yes |
Per vendor websites, as of October 2026. "Not stated" means not listed on the vendor website.
fuentis
The DPMS of the fuentis Suite 4 maintains the RoPA hierarchically: each entity can have its own record. Via the asset management link, IT systems are mapped to processing activities, and a personal data breach runs through the incident management module with automatic deadline calculation.
DataGuard
According to its pricing page, DataGuard offers the platform as SaaS alone or with Expert Support; the external data protection officer (DPO) is an add-on. Prices are on request only.
Proliance 360
Proliance 360 targets, per the vendor, SMEs in the DACH region. PROLIANCE GmbH was known as datenschutzexperte.de until 2025. Per the pricing page, software and an external DPO can also be booked as a bundle.
heyData
heyData describes itself as a platform with an expert team for mid-sized companies, hosted in Germany. The "Datenschutz-Siegel" (data protection seal) in the Professional plan is the vendor's own seal, not a seal or certification under Art. 42 GDPR.
caralegal
Per the vendor, caralegal maps group structures with a holding company and subsidiaries. The price depends on the number of legal entities; users are unlimited. Hosting is in the Open Telekom Cloud in Frankfurt.
Which Data Protection Tool Fits Which Situation?
Organisations wanting to run data protection and information security on one data basis can evaluate fuentis. Companies without an in-house data protection department find software plus an external DPO at DataGuard, Proliance 360 and heyData. For groups with several companies, caralegal and fuentis list functions for company and entity structures respectively.
A record of processing activities linked to no IT system and no measure goes stale faster than it can be maintained. What matters is whether, in a personal data breach, the software immediately shows the affected processing activities and systems. The 72 hours under Art. 33 run from awareness, not from when the documentation is tidied up.
For a complete feature catalogue, Proliance 360, heyData and caralegal list all seven modules from the comparison table (RoPA, TOMs, DPAs, personal data breaches, DPIA, data subject requests, training); DataGuard gives no information on TOMs and DPAs. The fuentis DPMS focuses on the RoPA, TOMs, processors and the connection to ISMS, BCMS and incident management. On the security side, the comparison of ISMS tools from Germany and the comparison of NIS2 tools add further criteria.
Before deciding, test a real case: run through an access request under Art. 15 GDPR. How long does it take to find all processing activities concerning the requester, and who monitors the one-month deadline in the software?
CEO, fuentis AG
Expert in information security, data protection and risk management with extensive experience advising enterprises and public-sector organizations. Specialized in ISO 27001, BSI standards and modern risk-analysis methods.