Privacy management software: what matters

What is a privacy management system?

The term does not appear in the GDPR. It means the way your company organises its GDPR obligations and the evidence for them. At its core is accountability: the controller is responsible for compliance with the principles and must “be able to demonstrate compliance” (Art. 5(2)).

Art. 24(1) requires appropriate technical and organisational measures to ensure and be able to demonstrate that processing complies with the GDPR. Those measures are reviewed and updated where necessary. Where proportionate, they include appropriate data protection policies (para. 2).

Software is one possible tool for this; the law requires none in particular. The record of processing activities, for example, is kept in writing, which includes electronic form (Art. 30(3)).

Art. 5(2) · Art. 24(1) and (2) · Art. 30(3) GDPR

Which obligations should the software cover?

The DSK is the conference of Germany's data protection authorities. In its action plan for companies (Kurzpapier Nr. 8) it lists documentation duties that belong to accountability: the record of processing (Art. 30), the documentation of personal data breaches (Art. 33(5)) and of instructions to processors (Art. 28(3)(a)).

For a company with 50 to 250 staff, that means in daily practice: a record of processing activities, a description of TOMs under Art. 32, contracts with processors under Art. 28, data subject requests under Art. 15 to 22, and a breach log. Where a data protection impact assessment is needed, its documentation comes on top (Art. 35(7)).

Two deadlines should be visible in the software. You answer data subject requests without undue delay and in any event within one month, extendable for complex or numerous requests (Art. 12(3)). You notify a reportable breach without undue delay and, where feasible, within 72 hours (Art. 33(1)).

Art. 12(3) · Art. 28 · Art. 30 · Art. 33 · Art. 35(7) GDPR

What to look for when buying

The software should follow the required contents of Art. 30(1) and link entries: a service provider, its contract under Art. 28 and the activities it works on. Then you enter a change only once.

It should record who changed what and when. For the record of processing, the DSK recommends documenting changes and keeping that documentation for one year.

Your external data protection officer needs access, auditors need read access. All data should export in an open format, so you can switch vendors without losing records.

The software itself holds personal data, such as data subject requests and breaches. If the vendor runs it for you, it processes that data on your behalf: check the contract under Art. 28(3), where the data is stored and which sub-processors are involved.

Example: choosing with a real case

Muster Metall GmbH, a made-up company with 80 employees and an external data protection officer, keeps its record of processing in a spreadsheet so far. Contracts sit in a folder, requests in the management mailbox.

In two trial accounts it runs through a case it actually had last year: an access request from a former employee. It checks whether the software shows the deadline, which entries in the record are affected, and whether the reply can be filed with its date.

Finally it exports everything and opens the file. Software whose data cannot be exported completely is ruled out.

Which mistakes to avoid when buying

Do not buy software before someone in the company is responsible. Without a person who maintains the entries, it stays empty.

Do not expect the software to fulfil obligations. It records what your company decided and did, and its templates describe another business until you adapt them.

Do not decide without your data protection officer. They should be able to carry out their tasks under Art. 39 with it, such as monitoring compliance.

With an AI assistant: what the software should offer

An AI assistant such as Claude, ChatGPT or Copilot can draft entries for the record of processing, compare contracts with the points in Art. 28(3) and structure a data protection impact assessment along Art. 35(7). If the software offers an MCP server, an interface following the open Model Context Protocol, the assistant reads and writes in it directly.

Then ask what the assistant may do there: read, write, delete as well? And whether each entry shows that an assistant wrote it. Purposes, time limits and notifications remain your company's decisions as controller.

Whatever the assistant reads, its vendor processes too. Where the vendor acts as a processor, a contract under Art. 28(3) is required with it as well. A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough.