GDPR software · Data protection management
Last reviewed: 20 October 2026
GDPR software: your data protection obligations organised in one place
Records of processing, DPIAs, TOMs, processor agreements, data subject requests, data breaches, retention periods, consent and third-country transfers: the SimpleAct GDPR module keeps the registers and deadlines of your data protection management in one system – linked to your AI inventory for the EU AI Act.
GDPR module from Professional · Hosted in Germany · Demo: 30 minutes
- Registers instead of scattered spreadsheets
- Deadlines for requests and breaches calculated
- RoPA entries linked to AI systems
- One audit log for GDPR and the EU AI Act
Records of processing
Art. 30 GDPR · 4 processing activities
Applicant management
AI-based Application Screening
Contract (Art. 6(1)(b))
In review2026-10-15
Customer support chat
Service Chatbot "Lia"
Legitimate interests (Art. 6(1)(f))
Approved2027-02-03
Newsletter
Consent (Art. 6(1)(a))
Approved2027-01-21
Payroll
Legal obligation (Art. 6(1)(c))
Draft—
Data breach
Customer list sent to wrong recipient
72 h deadline · 41 h left
Data subject request
Access under Art. 15
1-month deadline · 18 days left
In short
GDPR software replaces the collection of spreadsheets, Word templates and email folders many organisations use to demonstrate their data protection obligations. In SimpleAct, records of processing, DPIA, TOMs, processors, data subject requests, breaches, deletion log and consent form one connected module – from the Professional plan, in the same system as the AI inventory.
What it is about
What GDPR software should do
The GDPR does not only require you to process personal data lawfully. It requires you to be able to demonstrate it: Art. 5(2) calls this accountability, and Art. 24(1) obliges controllers to implement appropriate technical and organisational measures "to ensure and to be able to demonstrate" that processing complies with the Regulation. Under the second sentence of Art. 24(1), those measures are reviewed and updated where necessary. Taking that seriously needs more than a privacy handbook written once.
In practice the evidence consists of several registers that refer to each other. The record of processing activities (Art. 30) names purposes, data categories, recipients and erasure periods. The recipients are often processors, for whom a contract under Art. 28 must exist. High-risk processing needs a data protection impact assessment (Art. 35), every processing a description of security measures (Art. 32). On top come cases with deadlines: data subject requests within one month (Art. 12(3)) and breaches, where feasible, within 72 hours (Art. 33(1)).
One spreadsheet per topic works while one person keeps everything in their head. It gets difficult as soon as several departments contribute, deadlines must be tracked or a supervisory authority asks what things looked like three months ago. GDPR software should therefore do three things: keep the registers structured and linked, calculate deadlines from events and log every change with person and time.
For organisations using AI there is a fourth point. The EU AI Act requires its own view of your AI systems, and many of them process personal data. If the AI inventory and the record of processing live in separate worlds, you maintain the same information twice – or not at all. SimpleAct was built for both frameworks from the start: an AI system and the related processing activity hang off the same record.
Software replaces neither the data protection officer nor the legal assessment of the individual case. It makes sure the assessment is documented, findable and current. Which obligations the GDPR imposes in detail is set out in our GDPR compliance guide, as a table with a roadmap and a self-check.
- GDPR areas, 10 of them from Professional
- 12
- GDPR areas, 10 of them from Professional
- Professional per month (€279 billed annually), excl. VAT
- €349
- Professional per month (€279 billed annually), excl. VAT
- System for GDPR and the EU AI Act
- 1
- System for GDPR and the EU AI Act
Modules
The areas of the GDPR module
Each area maps a specific obligation. The link leads to our guide with the legal position, tables and free templates – useful even if you do not use SimpleAct.
- Art. 30 GDPRfrom Professional
Records of processing (RoPA)
The RoPA as structured entries rather than a spreadsheet – the foundation the other areas refer to.
- Every item under Art. 30 plus legal basis and data source
- Legal basis as a fixed choice of the six values in Art. 6(1)
- Status draft, in review, approved, archived
- Review dates and date of last review
- Art. 35 GDPRfrom Professional
Data protection impact assessment (DPIA)
The DPIA as its own record, linked to the RoPA entry and the AI system – from the necessity check to approval.
- Necessity check with reasoning, including "not required"
- Risks with likelihood and severity
- Measures and residual risk
- Approval status with approver and time
- Art. 32 GDPRfrom Professional
Technical and organisational measures (TOMs)
TOMs as a living catalogue with implementation status and evidence rather than a Word annex on a shared drive.
- Skeleton of nine categories along Art. 32 in one click
- Four statuses up to "evidenced"
- Evidence links per measure
- Linked to processing activities and vendors
- Art. 28 GDPRfrom Professional
Processor agreements (DPA)
Processors, contracts and evidence per vendor – together with the vendor register that also holds your AI providers.
- DPA status with signature date per vendor
- Data categories and processor flag
- Third country and safeguards (e.g. SCCs) per vendor
- Next review date in the vendor register
- Art. 12, 15–22 GDPRfrom Professional
Data subject requests
Each request becomes a case with a calculated deadline, a status and a draft response pack.
- Request types under Art. 15, 16, 17, 18, 20 and 21
- Deadline calculated from receipt, overdue cases flagged
- Internal entry or public form
- Response pack as ZIP with RoPA extract and processors
- Art. 33, 34 GDPRfrom Professional
Data breaches
Each breach as an incident file with the 72-hour deadline in view and the documentation Art. 33(5) requires.
- Deadline calculated from the time of discovery
- Status from "open" via "notified" to "closed"
- Authority and data subject notification with timestamp
- Linked to AI system and RoPA entry
- Art. 5(1)(e), Art. 17 GDPRfrom Professional
Retention periods & deletion log
You set retention periods per processing activity in the RoPA and log completed deletions in the deletion log.
- Retention period per processing activity
- Deletions with date and link to the RoPA
- Evidence for storage limitation
- Part of the register export
- Art. 7 GDPR, § 25 TDDDGfrom Professional
Consent & cookie management
Consent purposes and records kept separately – and your website cookie banner configured from them.
- Purposes with category, legal basis, vendor and storage period
- Banner shows exactly the active purposes
- Records with timestamp, IP address only as a hash
- Export of records as CSV
- Art. 13, 14 GDPRfrom Professional
Privacy notices
Draft notices from a RoPA entry: purpose, legal basis, data categories, data subjects and retention period are carried over, then you review and version them.
- Draft from the RoPA entry
- Versions with preview and editing
- Language selection
- The legal review stays with you
- Art. 24, Art. 39(1)(b) GDPRfrom Professional
Training & awareness
Document data protection training and awareness measures for staff – as part of the evidence for accountability.
- Training with date and participants
- Overview of completed measures
- Included in the register export
- Separate from AI literacy under Art. 4 AI Act
- Art. 44–49 GDPREnterprise
Third-country tracker & TIA
You flag third-country transfers and safeguards in the RoPA from Professional. The transfer register with review status and TIA wizard is part of Enterprise.
- Recipient, destination country and basis
- SCC version and review status with date
- Transfer impact assessment as a guided flow
- Linked to vendor and RoPA entry
- Art. 37–39 GDPRfrom Professional
DPO management
Mandatory check under Art. 37 GDPR and Sec. 38 BDSG, profile of the data protection officer with appointment and notification date and task allocation under Art. 39.
- Check whether a DPO must be designated
- DPO profile with responsibilities
- Appointment and notification date (Art. 37(7))
- Included in the register export
- Art. 58 GDPREnterprise
Authorities & escalation
For larger organisations: response packs for supervisory authority requests and escalation workflows via webhook.
- Authority response packs
- Escalation cases with webhook
- All in the register export
The areas describe the current feature set. You enter the content – processing activities, measures, assessments – yourself; SimpleAct provides structure, deadlines and links, not the legal assessment.
Overview
Which obligation lands in which area
The table maps each area to its GDPR basis, the typical evidence and the plan. The full list of obligations with a roadmap is in the GDPR compliance guide.
- Records of processing
- What you evidence therePurposes, categories, recipients, erasure periods, TOM reference per activity
- PlanProfessional
- GDPRArt. 30
- DPIA
- What you evidence thereNecessity check, risks, measures, residual risk, approval
- PlanProfessional
- GDPRArt. 35, 36
- TOMs
- What you evidence thereMeasures per category with status and evidence
- PlanProfessional
- GDPRArt. 32, 25
- Processor agreements
- What you evidence thereDPA status, third country and safeguards, review date per vendor
- PlanProfessional
- GDPRArt. 28
- Data subject requests
- What you evidence thereReceipt, deadline, handling, response
- PlanProfessional
- GDPRArt. 12, 15–22
- Data breaches
- What you evidence thereDiscovery, assessment, notification, communication, measures
- PlanProfessional
- GDPRArt. 33, 34
- Deletion log
- What you evidence thereCompleted deletions linked to the processing activity
- PlanProfessional
- GDPRArt. 5(1)(e), 17
- Consent & cookie management
- What you evidence therePurposes and consent records
- PlanProfessional
- GDPRArt. 7; § 25 TDDDG
- Privacy notices
- What you evidence thereVersioned notices per processing activity
- PlanProfessional
- GDPRArt. 13, 14
- Training & awareness
- What you evidence thereCompleted training and measures
- PlanProfessional
- GDPRArt. 24, 39
- Checklist & register export
- What you evidence thereStatus of obligations; all registers as one JSON file
- PlanProfessional
- GDPRArt. 5(2)
- Third-country tracker & TIA
- What you evidence thereTransfers, safeguards, review status
- PlanEnterprise
- GDPRArt. 44–49
- DPO management
- What you evidence thereMandatory check, DPO profile, appointment and notification date
- PlanProfessional
- GDPRArt. 37–39
- Authorities, escalation
- What you evidence thereResponse packs, escalation cases
- PlanEnterprise
- GDPRArt. 58
Starter contains the EU AI Act core without the GDPR module. The GDPR module cannot be booked separately.
AI inventory ↔ RoPA
One AI system, both evidence chains
Many AI systems process personal data. In SimpleAct you link the RoPA entry directly to the AI system from the inventory.
Applicant screening, a service chatbot or AI-assisted document search is, for the EU AI Act, an AI system with a risk class and deployer duties – and, for the GDPR, a processing activity with purpose, legal basis and recipients. The AI provider is usually also a processor, sometimes based outside the EU.
When you record the AI system in the inventory, you link it to the matching RoPA entry, the DPIA and the provider from the vendor register. Risk class, DPIA status and DPA hang off the same record and the same audit history. Data breaches can be assigned to the affected AI system.
In the other direction SimpleAct shows gaps: AI systems without a RoPA entry and AI systems without a linked DPIA appear in their own lists. That way you notice when a department introduces a new AI tool nobody in data protection has seen yet.
- RoPA entry linked to the AI system
- DPIA linked to RoPA entry and AI system
- AI provider from the vendor register as processor
- Gap lists: AI systems without RoPA entry or DPIA
- Data breach assigned to the AI system
- One audit log for both frameworks
AI system · Application screening
Sample data from the demo tenant
AI-based Application Screening
Deployer · HR department
Risk class
High risk (Annex III)- In review
RoPA entry
Applicant management
- In progress
DPIA
Necessity: required
- DPA on file
Processor
Provider from the vendor register
- Linked
TOMs
9 categories
- Open
Retention period
set in the RoPA entry
Gap list
- 2 AI systems without a RoPA entry
- 1 AI system without a linked DPIA
Risk class, DPIA and RoPA on the same record
Module finder
Which areas do you need – and which plan fits?
Select what applies to your organisation. The finder shows the matching areas, the plan and the guide for each obligation.
Your result
Select at least one statement on the left.
Guidance for choosing a plan, not legal advice. Check which obligations apply with your data protection officer.
Spreadsheet or software?
Where spreadsheets and templates reach their limits
Good templates are enough to get started – our guides provide them for free. The difference shows in day-to-day operation, when several people contribute and deadlines run.
- Links
- Excel, Word, shared driveRoPA, DPAs and TOMs in separate files; references by hand
- GDPR module in SimpleActRoPA entry refers to processors, TOMs, DPIA and AI system
- Deadlines
- Excel, Word, shared driveCalendar entry or a mental note
- GDPR module in SimpleActDeadline calculated from receipt or discovery, lists sorted by deadline
- Change history
- Excel, Word, shared driveFile versions, if someone remembers
- GDPR module in SimpleActAudit log with person and time for every change
- Collaboration
- Excel, Word, shared driveOne file, one editor, many copies
- GDPR module in SimpleActRoles (admin, editor, viewer), single sign-on from Professional
- Approvals
- Excel, Word, shared driveAn email saying "looks fine"
- GDPR module in SimpleActStatus and approval with name and date, e.g. in the DPIA
- Evidence for the authority
- Excel, Word, shared driveHunting for files
- GDPR module in SimpleActRegister export of all areas as one JSON file
- Link to the EU AI Act
- Excel, Word, shared driveSeparate AI inventory or none
- GDPR module in SimpleActAI inventory and GDPR registers in the same system
- Getting started
- Excel, Word, shared driveImmediate, free
- GDPR module in SimpleActEntries are created in the interface – a file import is not available at present
To be honest: with few processing activities and no AI systems, our templates are often enough. The software pays off when registers should grow together.
Rollout
How to start with the GDPR module
A proven order – as a recommendation, not an obligation. The duration depends mainly on how much is already documented.
- 1
Create processing activities
Start with the processes every organisation has: HR, customers, website, communication. Enter purpose, legal basis, categories and retention period for each.
- 2
Link service providers
Assign processors from the vendor register, record DPA status and third-country details. Record AI providers at the same time.
- 3
Fill the TOM skeleton
Create the nine categories in one click and fill them with your actual measures and evidence. Mark planned measures as "in progress".
- 4
Connect AI systems
Link AI systems from the inventory to the RoPA entries. The gap lists show where a RoPA entry or DPIA is missing.
- 5
Open the deadline processes
Data subject requests and breaches are now recorded in the system – internally or via the public request form. Assign responsibilities.
- 6
Review and export
Go through the checklist, set review dates and store the register export as a snapshot. Then review on a regular rhythm, as the second sentence of Art. 24(1) requires.
Plans
The GDPR module is included from Professional
No add-on, no second licence: GDPR and the EU AI Act run in the same plan. Prices excl. VAT.
- Price
- Starter€199/month (€159 billed annually)
- Professional€349/month (€279 billed annually)
- EnterpriseOn request
- AI systems and users
- StarterUp to 5 AI systems & 3 users
- ProfessionalUnlimited
- EnterpriseUnlimited
- EU AI Act core (inventory, risk, checklists, docs)
- StarterYes
- ProfessionalYes
- EnterpriseYes
- GDPR: RoPA, DPIA, TOMs, DPA
- Starter–
- ProfessionalYes
- EnterpriseYes
- GDPR: data subject requests, breaches, deletion log
- Starter–
- ProfessionalYes
- EnterpriseYes
- GDPR: consent, privacy notices, training, export
- Starter–
- ProfessionalYes
- EnterpriseYes
- GDPR: DPO management
- Starter–
- ProfessionalYes
- EnterpriseYes
- GDPR: transfer tracker, authority packs, escalation
- Starter–
- Professional–
- EnterpriseYes
- Single sign-on (OIDC, SAML, LDAP)
- Starter–
- ProfessionalYes
- EnterpriseYes
- SCIM, REST API and webhooks
- Starter–
- Professional–
- EnterpriseYes
Try free for 7 days with the Starter scope (credit card required, cancel during the trial). We show you the GDPR module in a 30-minute demo.
And SimpleAct itself?
Where your data protection documentation lives
Your record of processing itself contains personal data – such as names of contact persons – and a lot about your organisation. That is why the provider of your GDPR software belongs in your own RoPA too.
SimpleAct platform data is processed in Germany: servers at Hetzner in Nuremberg, backups in Falkenstein. The data centre is ISO 27001 certified; the certificate covers the data centre, not SimpleAct as a company. Sub-processors are Hetzner, Stripe (payments; a provider based in the US), Brevo (email) and Anthropic (AI assistant, only if switched on); they are listed in our data processing agreement.
For your own RoPA this means: for the content you maintain on the platform, SimpleAct is your processor. The DPA under Art. 28 GDPR is available in full under Legal and as a PDF; the security whitepaper is in the Trust Centre. You can store both directly in the processor agreements area.
- Servers: Hetzner, Nuremberg
- Backups: Falkenstein
- ISO 27001: data centre
- Payments: Stripe (US)
- DPA under Art. 28 available in full
Guide
Looking for the obligations first?
This page describes the software. Which obligations the GDPR imposes, who they apply to and in which order to tackle them is set out in the GDPR compliance guide: with a table of all key articles, a nine-step roadmap, the fine levels under Art. 83 and a self-check that gives you a gap list with links.
- Obligations table: article, duty, who, resource
- Nine-step roadmap
- Self-check with gap list
- When a data protection officer is mandatory
FAQ
Frequently asked questions about GDPR software
More questions? We're happy to help. Send email · Try 7 days (credit card required)
Sources and status
Last reviewed on · SimpleAct editorial team
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- Art. 5 GDPR – Principles and accountability (German text)
- Art. 24 GDPR – Responsibility of the controller (German text)
- Art. 30 GDPR – Records of processing activities (German text)
- Art. 28 GDPR – Processor (German text)
- Art. 32 GDPR – Security of processing (German text)
- Art. 35 GDPR – Data protection impact assessment (German text)
- Art. 12 GDPR – Deadlines for data subject requests (German text)
- Art. 33 GDPR – Notification of breaches (German text)
- Art. 7 GDPR – Conditions for consent (German text)
- Art. 44 GDPR – Transfers to third countries (German text)
- Art. 37 GDPR – Designation of a DPO (German text)
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex
This page describes SimpleAct features and is not legal advice. The text of the GDPR in the Official Journal of the EU is authoritative. Feature set and prices as of the date above.
Changes to this page
- 20 October 2026 – DPO management is now included from Professional and has its own area. Authority response packs and escalation stay on Enterprise.
- 6 October 2026 – Rebuilt as a product page: twelve areas linked to their guides, overview table, AI inventory ↔ RoPA link, module finder, spreadsheet vs. software comparison, plan table. Note on data transfer to Stripe (US) added. The obligations overview and self-check moved to the GDPR compliance guide.
- 13 June 2026 – First version of the module overview.
See GDPR and the EU AI Act in one system
In 30 minutes we show records of processing, DPIAs, data breaches and the link to your AI inventory – guided by your questions.