Every way companies process GDPR, priced side by side
Seven routes carry the market, from a cookie banner to an in-house data protection officer. This page sets out what each one produces, what each one costs as published, and where ComplianceSME sits. Every figure is as published by its named source on 13 October 2026.
The law this page is published under. Comparative advertising that names competitors is lawful in the United Kingdom and the European Union, under the Business Protection from Misleading Marketing Regulations 2008 and Directive 2006/114/EC, where the comparison is objective, verifiable and compares services meeting the same need without misleading or denigrating. This page is built to those conditions: every figure is quoted as published by its source and dated, third-party transaction data is labelled as such, each route's genuine strength is stated, and all trademarks belong to their owners with no affiliation or endorsement implied. If any figure here is out of date, toolkit@compliancesme.com corrects it on evidence.
The bench
| Route | What it produces | GDPR coverage against the ICO's ten accountability categories | Published cost | What it does well |
|---|---|---|---|---|
| Consent platform Cookiebot, CookieYes, Termly, iubenda, Usercentrics | A cookie banner, consent logs, generated policies | Parts of two of ten | Free to 90 euros a month | Banners at scale: geotargeting, 47 to 60 languages, consent modes |
| Full privacy platform OneTrust, TrustArc | Dashboards, a live inventory, workflow records | Broad within GDPR | No list price; transaction medians 12,000 and 15,120 dollars a year (Vendr transaction data) | Continuous monitoring of data flows, DSAR workflow at volume |
| Compliance automation Vanta, Drata, Scytale | Control dashboards, audit evidence | GDPR mapped as one framework beside SOC 2 and ISO 27001; the written records stay yours to produce | No list price; transaction medians 20,000 and 25,000 dollars a year (Vendr transaction data) | Security telemetry from 400+ integrations, audit preparation |
| Template pack IT Governance | Fifty blank templates to fill in | Blanks across the set | 295 pounds year one, 150 renewal | Cheap start; the vendor ships over 500 template updates a year |
| Outsourced DPO | A named person, advice, breach support | The Article 37 role, which software cannot hold | 350 to 3,500 pounds a month as published | A human the regulator can call; the production work is excluded at the fractional tier |
| AI document generator Legiscope | Generated records, metered as tokens the vendor sells. Its terms describe the output as probabilistic and possibly “inaccurate, incomplete, inconsistent, fabricated” | GDPR only, across seven modules. The vendor claims no certification and records that one person builds, operates and evaluates the platform; the Lithuanian register shows one employee | 1,500 to 12,000 euros a year | Fast record generation, published module methods, EU hosting of the records |
| ComplianceSME | Finished documents with the article cited on every line: the Article 30 record, lawful bases, retention schedule, processor clauses, breach register | The GDPR toolkit produces a thirty-page report covering 95 obligations, and GDPR is one of 116 EU and UK registers on the same account | The full GDPR toolkit and the company law compliance of 28 nations are free in a free account. It runs in a dedicated Claude account on the Claude Max plan, 90 pounds a month paid to Anthropic. See the plans for more. | The documents a regulator asks for, produced from the instrument's own words, across the whole obligation register |
The two kinds of monitoring
Security platforms watch your systems: telemetry from cloud settings and access logs, raised without anyone asking. That is real, and it is not what we do. ComplianceSME watches the law: when an instrument changes, the toolkit it touches is updated, and anything the business is about to do becomes one question to its own account, answered from the instrument's own words with the documentation regenerated. One watches your configuration. The other watches your obligations.
The questions this page gets asked
We already have a GDPR system. What is worth checking?
Most systems we meet are a consent platform, which covers cookies well. The ICO's accountability framework has ten categories, and a banner touches two of them. The quickest test of the other eight is whether you can produce your Article 30 record of processing activities today.
What does OneTrust cost for a small business?
OneTrust publishes no list price. Vendr, which reports what buyers actually paid, puts the median at 12,000 dollars a year across 309 purchases, with a range from 1,620 to 48,215 dollars. TrustArc's median on the same source is 15,120 dollars. Those platforms are built for mid-market and enterprise privacy teams, and they are thorough within GDPR.
Is there a cheaper alternative to OneTrust or TrustArc for an SME?
For the documents themselves, yes. ComplianceSME's full GDPR toolkit is free on a free account, and the paid levels run from 50 to 500 pounds a month and carry 116 EU and UK obligation registers rather than GDPR alone. What the larger platforms give you that we do not is continuous monitoring of data flows and DSAR workflow at volume.
Does Vanta or Drata cover GDPR?
They map GDPR as one framework beside SOC 2, ISO 27001 and others, and they collect control evidence continuously from hundreds of integrations, which they do better than we do. What they leave to you is the writing: the Article 30 record, the lawful basis for each processing activity and the retention schedule are still yours to produce. Vendr's transaction medians for those platforms are 20,000 and 25,000 dollars a year.
Is a cookie banner enough for GDPR?
A banner answers the lawful basis question for cookies. The ICO states there is no hierarchy among the six lawful bases and no one-size-fits-all approach, so HR, payroll, CCTV and supplier data each still need a basis recorded. A study of the UK's top 10,000 websites by Nouwens and colleagues, published at CHI 2020, found that 11.8 per cent of banner configurations met the minimum legal requirements the authors derived from European law.
What does an outsourced data protection officer cost?
Of 140 UK and US providers surveyed, three publish a monthly fee: 350 pounds plus VAT for two hours a month, from 500 pounds plus VAT, and 900 to 3,500 pounds a month. The fractional band commonly excludes the production work, meaning large DPIAs, training at scale and drafting. A DPO is a person the regulator can call, which no software replaces.
Can a template pack make us compliant?
A pack gives you blank forms to fill in. One well-known GDPR documentation toolkit costs 295 pounds in year one and 150 to renew, and its own publisher ships more than 500 template updates and revisions a year, which is the honest measure of how quickly the documents go stale. The blanks still have to be filled by someone who has read the regulation.
Can AI write our Article 30 record?
Some tools generate one from a short description of the business. Read the terms before you rely on it: one such vendor's own contract describes its output as probabilistic and possibly inaccurate, incomplete, inconsistent or fabricated, and not legal advice. Our toolkits work the other way round. The system teaches the regulation first, then interviews the person running it, and the document it produces cites the article behind every line.
What about data breaches?
Notified personal data breaches across Europe now run at 443 a day, a rise of 22 per cent in a year, per DLA Piper's survey of January 2026. The question that matters is whether a breach register and a 72-hour notification procedure exist in writing before one happens. The free GDPR toolkit produces both.
We have SOC 2 or ISO 27001. Does that cover GDPR?
SOC 2 and ISO 27001 are security standards certified by audit firms and ISO bodies, not by data protection authorities. The only approved GDPR certification is Europrivacy under Article 42(5), and Article 42(4) states that certification does not reduce the controller's responsibility. A security badge and a GDPR file are two different things.
Do we need an Article 27 representative?
If you are established outside the EU or the UK and you offer goods or services to people there, or monitor their behaviour there, you need a representative inside that territory. It has to be a real establishment, so it is bought as a service: published fees run from 950 to 1,500 pounds a year, and from 2,700 to 9,000 dollars depending on turnover. It is one of the things software cannot be.
What is the cheapest way to get an Article 30 record?
A free ComplianceSME account. It carries the complete GDPR toolkit and the company law of 28 nations at no charge, and the GDPR toolkit produces the Article 30 record of processing activities, the lawful basis register, the retention schedule, the Article 28 processor clause table and the breach register, each duty cited to its article. The account runs inside a dedicated Claude account on the Claude Max plan, which is 90 pounds a month paid to Anthropic.
What does ComplianceSME not do?
We do not run consent banners, we do not watch your cloud configuration, and we do not hold the human roles: a data protection officer and an Article 27 representative are people, not software. What we produce is the written record the law names, kept current as the law moves.
Figures read 13 October 2026 from each vendor's published pricing pages; platform medians from Vendr's published transaction data, which reports what buyers paid, not list prices; DPO fees from providers publishing them and The Assurance Desk's survey of 140 providers; breach volume from DLA Piper's GDPR Fines and Data Breach Survey, January 2026; accountability categories from the ICO's published framework; the consent banner finding from Nouwens, Liccardi, Veale, Karger and Kagal, Dark Patterns after the GDPR, CHI 2020; the Legiscope lines from that vendor's own terms, security and subprocessor pages and the Lithuanian Register of Legal Entities, company code 304581221. All trademarks belong to their owners. Corrections on evidence to toolkit@compliancesme.com.