Checklist: 124 Criteria for your data protection management software (2026)
Set goals
Before you begin, consider the following questions: Why do you want to implement data protection management software? What is your focus? Do you want to improve the quality of your documentation or perhaps enhance collaboration with other departments? Or is your company aiming for process automation?
Answering these questions will help you use our list more effectively.
Core functions of data protection management software
The following functions are a must for any data protection management software.
Record of Processing Activities
Simple overview of processing activities
A RoPA is essentially a list of all processes in which personal data is processed. It is therefore important that the software provides a good overview and disposes of a search function or specific filter options (by department, service provider, status, etc.).
Export RoPA at the touch of a button
In the event of a request from the authorities, it is sometimes necessary to submit the RoPA. It is therefore essential to be able to export it at the touch of a button, preferably in PDF or Excel format. The minimum requirements of Art. 30 GDPR should be observed.
"Pass on" processing activities to other areas of the company
In many companies, there are processing activities (PAs) that are used in several subsidiaries. To avoid having to document these twice, good data protection software includes the function of "inheriting" or copying processing activities and managing them in one, central location. This saves you a lot of documentation effort.
Customized view according to user roles
When creating processing activities, data protection officers, process owners, and specialist departments work in close coordination. To simplify the work of the latter, it makes sense to offer them a more streamlined view. Fields that require data protection knowledge (e.g., the legal basis of a PA) are only needed by data protection experts—not by specialist departments.
File upload for evidence
What does the consent form for your newsletter look like? To be able to prove it, your company's marketing department should be able to store a screenshot directly in the processing activity.
Approval process
Processing activities can have different statuses ("in progress," "under review," "approved"). The software should also reflect this and enable an approval process depending on the user role. This also means that the specialist departments are not allowed to make any further changes during the review by the data protection experts – this helps avoid confusion.
Completeness check
To avoid unnecessary feedback loops, you need all the necessary information from specialist departments before approving a processing activity. Good data protection software does this with the help of a completeness check, which only allows the template to be submitted to data protection experts for review if all the required fields have been filled in.
Adaptive fields when specifying the legal basis
A legal basis must be specified for each purpose of a processing activity. However, depending on the legal basis, additional information may be required. The data protection software should therefore not only have a drop-down menu with predefined legal bases, but also display appropriate additional input fields for each legal basis. In addition, it is practical if certain legal bases are only assigned to specific areas of the company.
An example of different additional information: In the case of Art. 6 (1) (a) GDPR (consent), it should also be specified how consent is obtained, what it contains, and how it can be proven. If the legal basis is a contract (Art. 6 (1) (b) GDPR), it is sufficient to name it.
Specification of data types instead of data categories
Although the GDPR stipulates data categories (e.g., master data) in the RoPA, in data protection practice—and especially when information is to be obtained from specialist departments—data types (e.g., email address) should be discussed first. These data types should be specified in the processing activity. Ideally, these are already provided in a drop-down menu and assigned to data categories to make it easier for the specialist departments to make their selection.
Please note: Authorities often request information about data types even though these are not explicitly mentioned in the GDPR. It is therefore important to clearly assign data types to data categories.
Preselection of data types by group of persons
In processing activities, it must be specified which group of persons' data is being processed. To speed up processing, a data protection software filters these data types according to the preselected group of persons.
Flexible assignment of external recipients to individual data categories
In addition to the data source, RoPAs also specify the storage locations and the internal and external recipients. If several data types are processed in a processing activity, these may need to be assigned to different external recipients. It is therefore essential that a data protection management software is able to present this differentiation in a simple and understandable way so it remains easy to follow.
Distinction between data storage locations and external recipients
When using Software-as-a-Service solutions, the data storage location and the external recipient are often identical—for example, Sendinblue newsletter tool and Sendinblue GmbH. However, differentiation is necessary if a service provider offers several products—such as Atlassian with Confluence and Jira. Therefore, a data protection software should offer separate fields for data storage locations and external recipients.
Note: Specialist departments are often unaware of which external recipient is behind a piece of software. Nevertheless, this must be documented. For this reason, it is particularly helpful if this is added automatically when entering software.
Legal retention periods are stored
Good data protection management software stores the standard legal retention periods for different document types so that they can be selected from a drop-down menu and the storage period and the start of the retention period are automatically stored. This saves users time, as they do not have to manually research and enter the retention periods. Good software also offers the option of adding multiple periods to a processing activity and entering your own internal retention periods.
PAs are the basis of the deletion concept
To create a deletion concept, data protection officers need the storage period and deletion practice for each processing activity. The necessary information comes from the individual processing activities, which is why a software should already collect deletion periods and types in a structured manner.
Create or attach a data flow diagram
Data flow diagrams are used to illustrate data processing activities, especially in complex data processing cases, and thus to facilitate review by data protection experts. A data protection software should therefore ideally already display data flows visually. At the very least, it should be possible to assign diagrams to the individual data processing activities.
Add processing-specific technical and organizational measures
As a rule, companies implement comprehensive technical and organizational measures (TOMs) that apply to all processing activities. In practice, however, certain TOMs are only used for specific processing activities. Your data protection management software should therefore be able to meet this requirement and distinguish between general and processing-specific measures.
Assigning risks to processing activities
In companies with a high level of data protection maturity and comprehensive risk management, a risk assessment is often carried out for each processing activity. If this is the case for you, the appropriate data protection software must offer this, even if no DPIA is created.
Automated threshold analysis
A threshold analysis is used to determine the need for a DPIA. A catalog of nine questions has been established in practice for this purpose. The data protection management software should not only offer this (e.g., via yes/no selection fields), but should ideally also provide background information and examples of when a question should be answered with yes. Ideally, the software will suggest whether a DPIA is necessary based on the given answers.
Blacklists and whitelists
When determining whether a DPIA is required, supervisory authorities have published so-called blacklists and whitelists. These lists outline processing activities for which a DPIA is always mandatory, as well as those for which it is not required. Your data protection management software should provide these and, based on it, indicate whether a process appears on one of these lists.
Please note: These lists vary from German state to state and are updated regularly. Here we have linked the DSK list for the non-public sector, which several states refer to.
Create and assign comments
Processing activities are often maintained jointly by data protection experts and specialist departments. This naturally raises questions from time to time. The data protection software should allow field-specific comments to simplify collaboration.
Version history for easy traceability
When several people work together on a processing activity, it makes sense to be able to see the processing history. Changes should therefore be traceable and displayed in the data protection software.
Restore version history
Sometimes, information in a processing activity is accidentally deleted that is still required later. In this case, it is important that the software can list what information was previously available. Restoring this status quo is another plus.
Display processing activity as a workflow
Specialist departments should be able to provide relevant information about processes. It is important not to overwhelm users with too many input fields. It therefore makes sense to divide up the parts of a processing activity – ideally in the form of a workflow. Modern data protection management software reflects this and rewards users by making progress in their work visible.
Create processing activities as a processor
According to Art. 30 (2) GDPR, a RoPA must also include those processes in which the company acts as a processor. This results in slightly modified requirements compared to processing activities from the perspective of the controller. Make sure that your data protection software is designed for this purpose.
Data protection impact assessments
For particularly risky processes, companies must carry out a data protection impact assessment (DPIA) in advance in accordance with Art. 35 GDPR. Data protection solutions should take a number of things into account here:
Direct link to the Record of Processing Activities
To perform and document a DPIA, you usually need, among other information, all the information that has already been documented in the processing activity. You can save yourself duplicate work if the data protection software automatically links both functions or transfers the information from the PA to the DPIA.
Free text input and collaboration features
A DPIA is a comprehensive analysis. In many companies, legal experts work together with project teams. Within a data protection management software, multiple users should be able to access a text at the same time, work on it together, and assign comments. Collaboration and iteration are fundamental here.
Identifying and assessing risks
As part of the data protection impact assessment, risks must be identified and assessed. Typically, this is done based on their probability of occurrence and the amount of damage they could cause. Ideal software already has a preselection of assurance objectives that are assigned to the individual risks.
Preselection of risks and TOM
Ideally, your software should have the ability to access a central repertoire of risks and the associated technical and organizational measures in the course of risk analysis and risk treatment.
Documenting compliance with data subject rights
In the case of a DPIA, it must be ensured that the rights of data subjects are respected. The software should identify these rights and their relevance. To this end, it must be specified which measures can be used to guarantee the rights of data subjects.
Export function for consultation with the supervisory authority
If a high risk remains despite the planned measures, it may be necessary to consult the supervisory authority. In this case, a DPIA must be submitted to the authority. It must be possible to export it from your data protection management software, and the document created must include the address and contact person of the company. In the case of group companies, this must be adaptable for individual subsidiaries.
Technical and organizational measures
Technical and organizational measures (TOM) are measures to ensure the security of the processing of personal data in accordance with Art. 32 GDPR.
Accessing templates
TOM serve to mitigate the risks of data processing. A program should therefore enable you to identify suitable measures using a template catalog. An ISO 27001 catalog, for example, can be helpful here.
Assign TOM to assurance objectives
Protection goals are derived from the principles of Art. 5 GDPR. These include:
- Ensuring availability and recoverability
- Integrity
- Confidentiality
- Transparency
- Interoperability
- Non-linkability of personal data processing
Individual TOM can be assigned to each of these objectives in practice. This should be mapped automatically by data protection software.
Overview of TOM and their status
Which TOM has your company already implemented? In which processes are they used exactly? Planned or already implemented – what is the status of a TOM? All these questions must be visible at the touch of a button in your data protection management software.
Link TOM and risks
TOM are the answer to data protection-related risks. Your software should show which TOM mitigates which risk. This saves the user valuable time when the same risk occurs in a new process.
Data breaches and incidents
A data breach has occurred – what should you do now? This process should be clear in every company. With the following functions, you have a reliable data protection management software at your side.
All employees can report an incident
When a data breach occurs, every minute counts when it comes to taking action. It is important that data protection coordinators or data protection officers (DPOs) are informed as quickly as possible. Your software should support coordination by giving all employees access and providing them with a simple form for reporting the incident. The responsible persons must then be automatically informed by email.
Derive measures
Once a breach has been reported, it must be clarified which data from which persons are affected and what effects can be expected. A good data protection software identifies the data and the (groups of) data subjects affected, as well as the systems in which the data is stored. The software is also able to provide information about the measures to be taken.
Document the decision
Do data subjects need to be notified? Is this a reportable incident? Software is used to document these questions in an audit-proof manner.
Derive and track tasks
A data breach gives rise to numerous tasks for those responsible – depending on whether or not reporting is necessary. Your data protection management software should take over task management centrally and enable you to assign tasks, set deadlines, and keep track of them.
Export for reporting to an authority
If the data protection officer and executive management conclude that a report must be made to the authorities, it must contain specific information. Your software should be able to export a documented data breach at the touch of a button.
Data subject requests
Your company needs standardized processes for the different types of requests from data subjects. Your data protection management software is able to provide operational relief and structure.
Receiving requests via web form
Many companies make it easier for themselves and data subjects alike by offering dedicated web forms for submitting data subject requests. The advantage for the company is that requests are bundled directly in the data protection management software.
Document data subject requests correctly
The steps that follow a request depend on the type of data subject request. In practice, requests for information (under Art. 15 GDPR) and requests for erasure (under Art. 17 GDPR) predominate. Your software should be able to support the correct request classification and specify the processing procedure based on this classification.
Integration with email client or customer support software
As a rule, data subject requests are sent to companies by email. Depending on your company's tech setup, it may be advisable for your data protection software to enable a connection to your email client or customer support software. This allows an automation of processes and a reduction in manual effort.
Customizable workflow per business unit
In large corporations in particular, data subject requests are recorded for each organizational unit. A modern data protection software supports this with customizable workflows that trigger an individual process with predefined responsibilities for each subsidiary.
Provide an overview of data storage locations
When it comes to deletion requests, it is particularly important to delete all data relating to the data subject, provided that no retention obligations prevent this, taking into account statutory retention periods. With a well-maintained RoPA, your data protection management software must provide an overview of the IT systems in which the person's data is or could be stored.
Portal for the secure transmission of responses to data subjects
A secure portal for data subject requests enables the encrypted transmission of sensitive information and ensures that only authorized recipients have access to it. Instead of using insecure email communication or physical document delivery, data is provided via a centralized platform that integrates various security mechanisms.
Assigning tasks to employees
Your data protection management software facilitates the automatic assignment of data subject requests to the responsible employees, ensuring rapid handling. Responsibilities, deadlines, and progress can be managed centrally, allowing requests to be coordinated efficiently and bottlenecks to be avoided. In addition, an email reminder function ensures that tasks are completed in a timely manner.
Templates for communication with data subjects
Standardized templates for communication facilitate legally compliant and consistent responses to data subject requests. Predefined text modules for requests for information, deletion requests, or objections save companies time and minimize errors. In addition, dynamic placeholders allow messages to be customized for data subjects.
Deletion concept
The need for a deletion concept arises from Articles 5 and 17 of the GDPR. In practice, a data protection software can provide significant added value here.
Automatic transfer of data from the RoPA
A deletion concept specifies who must delete which data and when. This contrasts with the legal retention obligations. All this information should already be documented when a processing activity is created. Your software then has the simple task of aggregating this data in the form of a deletion concept.
Export of the deletion concept for appointments with authorities
Data protection authorities prefer to review deletion concepts because they show whether your company is complying with deletion obligations. Structured export should be possible with the right software.
Display and track deletion dates
The deletion concept provides visibility to your company about when which data may or must be deleted. Your data protection management software should map this information specifically for business units or IT systems.
Enable deletion logging
All companies must prove that they are actually complying with their deletion obligations. In practice, so-called deletion logs are used for this purpose. Your data protection software should allow you to store these in a clear and organized manner.
External data transfer, order processing, and service provider management
When personal data is passed on to external service providers or business partners, data protection must first be ensured. The necessary checks and documentation can be simplified by using an appropriate software.
A well-structured list of all external recipients
Your data protection management software must provide answers to the following questions: Which external recipients are used in which area? Have they already been checked and approved by the data protection team? Detailed filter options and an export function are also advantageous.
Manage products and services
Since external recipients often offer multiple products or services, your data protection management software should allow for a clear separation between external recipients and the respective products and data storage locations.
Document general information and contractual agreements
Basic information about a service provider and the contractual agreements form the basis of the data protection audit. An ideal data protection program enables the specialist departments to enter this general information and store contracts or contract templates. This allows your data protection team to check the approval of the service provider.
Support with compliance checks for external recipients
The data protection review of a service provider and, above all, the review of the data processing agreement (DPA) is an important task. However, the necessary audit steps differ depending on the type of contractual relationship (e.g., DPA vs. joint controller) or the location of data processing (e.g., Germany vs. the US). A data protection software must respond adaptively to the inputs and provide users with the correct audit workflow until the external recipient can be approved.
Enable communication with specialist departments
Specialist departments form the link between the data protection team and the external recipient. If further information is required, this must be coordinated with those departments. For this purpose, a data protection software should have a field-specific task or comment function.
Enable communication with the external recipient
If your company has many external recipients, it may be more efficient for them to provide the necessary information for review themselves. To this end, data protection software offers customizable questionnaires that you can send directly to external recipients via the software.
Description of processes involving an external recipient
Your data protection software should show the link between external recipients and processing activities. It must be clear in which process a service provider is used.
Document storage
A DPMS software serves as a Single Source of Truth. Ideally, your company should be able to collect all data protection-related documents here and use links to other storage locations.
Document center
Data protection notices and guidelines are usually created using Office applications. Data protection software should collect and categorize these documents centrally.
Consent directory or management
Organizations that obtain consent for data processing on a large scale benefit from software with a centralized consent management. In it, the documents can be assigned to individual organizational units.
Management functions
In addition to the core data protection functions, a good data protection management software also offers various coordination and control functions.
KPI measurement and reporting
In order to improve data protection management systems, they must be made measurable using helpful KPIs.
Clear dashboard with filter function
Although data protection is all about the details, your company's data protection team needs instant access to key facts & figures for communication with C-level management. Your data protection management software assists in measuring changes in important KPIs with easy-to-understand dashboards. For example, the number of reported data breaches per business unit can provide insight into the level of data protection awareness.
Track activities (for external DPOs)
Especially when using external data protection officers, a software can help with the traceability of the tasks performed. This allows the client to see at a glance which activities the data protection officer has carried out and billed at the end of the month. This function is generally not relevant for internal data protection teams.
Create annual reports
At the end of the year, external data protection officers report to their clients on the measures they have taken with regard to data protection in an annual report. A DPMS software can provide suitable templates for this purpose or automatically create a client-specific report through a structured export. This function is also usually of lesser relevance for internal DPOs.
Auditing and assessments
Companies conduct internal and external audits and assessments to regularly review their data protection management. These audits cover specialist departments, entire companies, or external service providers. A data protection management software provides valuable support in this regard.
Provide audit templates
Data protection audits provide you with an overview of the status quo of data protection in your company or a specific area. In addition to documentation, processes are also reviewed, for which a data protection software can provide audit templates.
Create a questionnaire
Various question types and components such as checkboxes, multiple-choice or single-choice options, and free text entries are helpful for creating questionnaires. Some programs also offer a dynamic if-then logic, which automatically adapts the questionnaire to previous answers. This enables a more targeted collection of relevant information and optimizes the processing workflow.
Send questionnaires to employees (internally)
A data protection management software takes care of sending questionnaires to employees on your behalf. You often select the names of employees in the software or enter their email addresses. They should then be notified automatically and reminded to respond.
Send questionnaires to external service providers
Sending questionnaires to external service providers can simplify data protection compliance. A modern data protection software allows you to send questionnaires automatically by entering an email address and helps you track responses.
Interview mode
Many audits are conducted by an auditor in a face-to-face meeting. A DPMS software helps the auditor to record their notes in a structured way.
Create audit report
An audit report reflects the scope and findings of a data protection audit. Good data protection management programs generate this report automatically. The Word format is particularly suitable for this activity, because it allows the auditor to make changes, such as adding a company stamp and signature. At the beginning of the report, a management summary should summarize the most important findings.
Export audit responses
A data protection management software should support the export function for audit responses in order to efficiently store and process evidence. Exporting to common formats (e.g., PDF, Excel) allows auditors and data protection officers to quickly access relevant information. In addition, a structured data preparation facilitates the analysis and documentation of compliance measures.
Convert audit findings into tasks and monitor them
The areas for improvement identified during the audit represent tasks for the future. A DPMS software should be able to assign audit findings directly to individuals through task management and track their implementation.
Good to know: Prioritization and setting deadlines are usually the responsibility of the auditor.
We have covered best practices for data protection audits in a separate article.
Collaboration
A DPMS software is often seen as a tool for experts. However, this is mainly because many offerings are not designed for "data protection novices." To effectively implement data protection in your company, other departments should also be involved.
Create, assign, and track tasks
Data protection management has a lot to do with project management. This means that tasks and responsibilities must be clearly distributed. Therefore, your data protection software must have solid task management functions. Information about which tasks data protection experts have assigned to other employees and which deadlines are approaching is particularly important.
Receive notifications
When tasks are assigned to a person, it is important that they are informed. This can be done via a display function in the software or by email. Integration of the program into communication software such as Slack or Microsoft Teams is advantageous.
Recurring tasks or resubmission
Data protection management involves regularly recurring activities. For example, processing activities should be reviewed every six to twelve months to ensure they are up to date. A modern data protection software can be used to create recurring tasks, often referred to as resubmissions.
Role, user, and organization management
The processes and responsibilities of your organization must be mappable within your data protection management software. There are a few things to consider:
Easy addition of users
Adding new user accounts should be as straightforward as possible, e.g., via email address. To invite a large number of users, the software should have a "batch" function. Even better is the option to connect to an existing Single Sign-On (SSO) solution.
Flexible definition of user roles
A data protection officer uses DPMS software to a different extent than a specialist department. These differences are covered by specific user roles. Ensure that the user roles you need in your organization are available. Ideally, permissions can be defined flexibly.
Enter organizational structure
The organizational structure forms the basis of data protection management. It is therefore important to ensure that legal entities as well as departments and teams can be stored in the software and that individual users can be assigned to these areas.
Group and client capability
Some programs offer the option of displaying group companies or the group structure. External DPOs have the option of managing multiple clients in one software program via a single account.
Note: Detailed requirements for corporations and enterprise companies are provided in the section "Enterprise requirements."
User-friendliness of the software
Which functions enable users to work more effectively with data protection management software? In data protection, great usability means responding to the existing expertise of individual users.
Adaptive user interface
An adaptive user interface allows users to see different fields depending on their role. This is because individuals have different requirements and tasks within a data protection software. Users from specialist departments, for example, do not need to know the specific legal basis. A user-friendly DPMS software adapts to its users.
Explanatory texts, recommendations for action, and examples
The language used by data protection experts often poses challenges for specialist departments. What are examples of the purpose of data processing? Who is an internal recipient? The ideal data protection software proactively clarifies questions with simple explanatory texts and examples, so that the experts do not have to spend time explaining everything to non-expert colleagues.
Receive information on current data protection issues
Legal requirements and best practices in data protection management are constantly changing. Are standard contractual clauses required for a service provider? What are the statutory retention periods? These are two examples of areas where a data protection software can help.
Central resource management
Consistency in the use of key terms and designations is crucial for the long-term quality of data protection documentation. For example, it saves a lot of time if data types and categories such as email addresses and master data are managed from a central resource register. This allows users to choose from a preselected list of data types.
Harmonize resources with one click: "cleanup function"
Data protection documentation often lacks consistency in the naming of central resources, such as the specification of the legal basis or the designation of data types. To ensure consistency, modern data protection management software can merge or harmonize different resources with a single click. This saves valuable time in ensuring data consistency.
Technical and security-related factors
A data protection management software contains a lot of your company's confidential data. Therefore, make sure that user authorization and authentication meet the highest security standards.
Login procedure via email and secure password
The most common way to log in to software is with a combination of email address and password. Make sure that the software enforces strong password policies to ensure login security.
Single sign-on
Single sign-on (SSO) logins ensure that only users from your company have access to the data protection software. In the enterprise segment, it also makes sense to connect to an Active Directory (AD).
Two-factor authentication (2FA)
2FA is already standard in many tools. You should also make sure that 2FA is available for your company's data protection software—after all, the software contains confidential information.
Good to know: Two-factor authentication can be achieved through one-time codes via SMS, email, or even authenticator apps.
Cloud vs. on-premise
There are few topics related to application security that divide opinion as much as the question: "Hosting on-premise or in the cloud?" Your company will usually already have a clear opinion on this, which you can pass on to your potential software provider. However, be aware of the advantages and disadvantages of both options. Cloud solutions, for example, usually offer shorter update cycles and can be set up more quickly for your company.
ISO 27001 certification of the provider
ISO 27001 certification confirms that the provider of a data protection management software complies with the highest security standards for the protection of sensitive data. This reduces the risk of data breaches, strengthens compliance, and gives companies the assurance that their data is being processed in a security-certified environment.
Note: Pay attention to the scope of the ISO certification. This can cover the entire company or just product development.
Enterprise requirements
Interfaces (APIs)
If you want to link other tools—e.g. for process management or contract management—to your data protection management system, there must be suitable interfaces available, known as application programming interfaces (APIs). Pay attention to the existing documentation of the Rest API, which gives you an initial overview of the standardized options for automatically receiving or sending data. Providers in the enterprise segment are also experienced in mapping individual connections and workflows.
Connection to an Active Directory
Large companies usually have an Active Directory that is managed by central IT. This allows the role and authorization system to be managed centrally. A data protection software for the enterprise segment offers the option of connecting to Active Directory, e.g., Microsoft/Azure AD, Okta Identity Cloud. This allows the roles and authorizations in the software to be controlled by Active Directory.
Transfer of rights when a user is deleted
When an employee quits your company, you must ensure that all tasks and responsibilities within the scope of data protection management are transferred to another person. A data protection management software can help you do this by selecting another user (with the appropriate permissions) to take over the tasks of the former user when a user account has been deleted.
Customizable notes within the software
Notes such as examples, recommendations for action, and tips within your data protection software make it easier for users to perform their tasks. Especially in large corporations, it can be useful to customize these notes to the specific needs of your data protection management system. Some data protection software providers in the enterprise segment offer this customization option.
Automatic translations of the entire documentation
Multilingualism is particularly important for internationally operating companies – including your data protection software. Ideally, the program should automatically translate user input.
Implement multilingualism coherently
If your company has locations in different countries, your employees often use different languages. When selecting your data protection management software, make sure that it supports all languages natively in the system.
Support resources in multiple languages
It may seem simple, but a key challenge in an international data protection management is managing user entries from different languages in a consistent manner. For example, the data type "email address" in German corresponds to the French "adresse électronique." If users were to create this data type in different languages, this could lead to data inconsistencies. A leading data protection management software bundles such data types centrally and enables automatic translation into all supported system languages – for consistent and efficient management.
Inheritance of processes, measures, and risks to other areas of the company
To avoid duplicate documentation across group companies, a reliable data protection software offers the function of "inheriting" or copying processing activities, for example, and managing them in a central location. The same applies to measures, risks, and other key information.
Adaptation of resource templates for each business unit
Your data protection software offers you a list of predefined selection fields in many areas, enabling your employees to work more effectively. It is important for large companies operating in different countries to be able to adapt these selection fields to each business area. This means, for example, that only German retention periods can be selected for your subcontractors in Germany, but not for those in Italy or Austria.
Enabling changes in your organizational structure
In large corporations, it is not uncommon for business units to be created, merged, or restructured. A powerful data protection management software should automatically support these changes to ensure a smooth transition. Make sure that areas can be flexibly moved or replaced without losing important documentation and data or having to maintain them with a great deal of manual effort.
Implement a granular rights and roles concept
A granular rights and roles concept within your data protection management software makes it possible to precisely tailor access rights to corporate structures and responsibilities. This enables corporations to ensure that only authorized persons have access to sensitive data and functions, while at the same time meeting compliance requirements. Differentiated rights assignment allows permissions to be controlled dynamically, which is essential especially in complex organizational structures, international teams, and changing changing responsibilities.
Other important things to consider
Criteria for software providers
Supplier due diligence is an essential part of the comprehensive evaluation of a software solution.
Free demo
Have the software presented to you and make future users join you for this product presentation. Representatives from the departments involved should also be present if necessary. If anything is unclear, it is best to request a second demo, because once your company has introduced a data protection management software, it will not change it again anytime soon.
Free trial period
Try out the program yourself during the free trial period and talk to other potential users in your company. When testing, be sure to work with test data and simulate real-life application scenarios.
Good to know: Some providers make test data available to enable a robust test.
Clarify support
How does the provider offer support if problems or questions arise regarding the data protection management software? Is the company itself responsible for support, or has support been outsourced to a subcontractor? Is support available by phone or only by email?
Important: The availability of support often depends on the package you have purchased.
Provider's data protection management expertise
A data protection management software provides significant support for data protection officers in your company. It is therefore important that the provider disposes of expertise in data protection law. In addition, they should understand how processes work in your company—especially with regard to the size of your organization.
Location in the EU
When making your selection, ensure that the provider is based in the EU and that its software has been explicitly developed for the application of the GDPR. Otherwise, complex adaptation to European law may be necessary. In addition, the servers should ideally also be located in the EU.
Provider's business model
Before you decide on a data protection management software, you should find out how the provider makes money. If the business model mainly consists of providing external data protection officers, the software will probably not really make things easier for your employees.
In some cases, costs also increase with the number of users in your company, which can hinder the involvement of additional colleagues.
The provider's mission
During the selection process, consider whether the software provider's medium-term goals are in line with those of your company. This will have a significant impact on the further development of the software.
Product portfolio
Is data protection management the core of the software or just an add-on? Since the introduction of the GDPR in 2018, many providers have expanded their existing systems to include data protection modules – with varying degrees of success. Therefore, carefully check where the company sees its own unique selling point (USP) and whether this is in line with your goals.
Update cycles
The update cycle gives you an idea of how future-proof a software is. Incremental weekly updates are preferable to quarterly updates. Also, take a look back: How many new features were added last year? Was the data protection management software regularly adapted to current case law?
References
As part of your selection process, you should check which companies already use the provider's software. Do they have similar requirements to yours? Feel free to request contact details for the provider's existing customers to gain insight from their perspective.
Onboarding & Setup
A data protection software can facilitate onboarding through various functions.
Importing existing documentation
You will usually already have existing data protection documentation. When introducing data protection management software, you should consider how this existing data will be transferred to the software. Some providers offer automated import processes from the most common file formats (CSV, Excel, Confluence, Word, etc.). Especially with large data sets, you will save time and manual effort if the import does not have to be carried out manually.
Provision of templates
In data protection, templates serve to build on existing documentation or processes. Make sure that your data protection management software supports templates (e.g., for processing activities, TOM, risks). Some providers also offer their own templates.
Note: As the term "template" suggests, these usually serve only as templates and must be adapted by companies to their specific requirements.
Training concept
When choosing your software, consider how you and your colleagues will be introduced to it. Check whether the offering meets your requirements: Does it include personal training for administrators and specialist departments, general webinars or training videos, or is there a manual?
Implementation effort and support
How long does it take to introduce and customize the software? And how does the provider support you during the implementation phase? Ask the provider for a project plan that breaks down the responsibilities and dependencies.
Pricing
The introduction of a DPMS software is, of course, also a financial decision, and pricing varies between different providers. You should therefore clarify the following components in advance.
What exactly is priced?
SaaS providers in particular tend to charge for software usage on a monthly basis, with the price adjusting dynamically to factors such as the number of users, documents managed, or companies managed. These variable costs can change on an ongoing basis, which makes budget planning difficult. To ensure planning security, you should analyze the underlying pricing models in detail and perform a total cost of ownership (TCO) calculation.
Costs and duration of customizations
The cost of customizing the software to your organization's needs depends on the provider and your company's requirements. You should therefore clarify at an early stage who will carry out the customization and whether any costs will incur.
Implementation costs
The implementation costs of a data protection management software include not only license fees, but also the costs for setup, training, and integration into existing systems. Some providers rely on external implementation partners to take on some of the work, but these costs must also be taken into account in the overall cost calculation. Other providers implement the software themselves in close alignment with you.
Note: The time required to implement a new data protection software depends on many factors. Clarify with your provider in advance how quickly you will be able to work productively with the new system.
Advanced solutions
These solutions are not part of the core functionality of data protection management software, but are offered as add-ons by some providers. Depending on the area of application, it may make sense to integrate them into a data protection management software or to use specialized providers.
Creating and managing a privacy policy
If your record of processing activities (RoPA) is kept up to date with due care, you can use the information it contains when drafting your privacy notice. A DPMS software can also support the creation of privacy notices in accordance with Article 13 GDPR, or at least their efficient management.
Cookie banner / consent management
As soon as a website uses cookies beyond those that are strictly necessary, a cookie banner is required. This is typically provided by specialized vendors. A data protection management software can nevertheless be used to document the banner's settings and wording.
Website cookie check
Companies should regularly check the cookie settings on all URLs of their website. After all, even one incorrect setting on a single page is sufficient to cause data protection issues. An automated website cookie check can help fix this.
Data protection training for employees
This feature is particularly effective when it comes to interactive training courses rather than digitized lectures. Integration into your own learning management system (LMS) is also advantageous. After successful completion, employees should receive a certificate.
Online legal library
Some software providers offer access to current specialist literature and primary content. This is extremely beneficial for data protection experts. It also makes sense to integrate it into the workflow of a DPMS software.
Asset management
The management of company-specific assets is a main issue in information security – but linking to an asset register can also be of great benefit in data protection management. It enables a more precise assignment of processing activities to IT systems, devices, or databases. Some data protection management software solutions offer integrated asset management for this purpose.
AI compliance management
Ensuring compliance with the AI Act is closely related to data protection. Accordingly, some data protection management software solutions already support AI compliance, allowing organizations to benefit from synergies with existing data protection documentation.
Conclusion: There is a lot to consider
When selecting the optimal data protection management software for your organization, there are many factors to consider. Nevertheless, the effort is worthwhile, as a professional solution can support your organization in multiple ways.
Which of the listed 124 criteria are decisive for your organization depends not only on company size, but above all on the data protection maturity level of your overall data protection organization.
We hope that this comprehensive list has provided you with useful guidance for your search.
One final piece of advice: Talk to other organizations with requirements similar to yours. They can often offer valuable insights into the strengths and weaknesses of existing solutions.
Of course, the experts here at caralegal are also happy to support you - with no strings attached.
