GDPR compliance is an organizational responsibility, not a software feature. A privacy-management platform can help teams document processing, assess risk, manage requests and retain evidence, but it cannot decide every legal question or establish compliance on its own. The GDPR requirements your program must address depend on your organization’s role and processing context. OneTrust and TrustArc both describe workflows for supporting that work; the available public descriptions do not establish an independent overall winner.
What are the GDPR requirements?
The General Data Protection Regulation (EU) 2016/679 sets out duties for organizations that process personal data within its scope. The specific duties depend on facts such as an organization’s role, the processing involved and applicable exceptions. The regulation itself—not a vendor’s summary—should be used to assess legal obligations.
![Accident Report Book GDPR Compliant: Essential Workplace Safety Log for Incidents, Health and HSE Reporting Across All Sectors [A4 Size]](https://m.media-amazon.com/images/I/41TlU+HXpHL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
Apply the data-protection principles
Article 5 requires personal data to be processed according to seven principles:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Lawfulness, fairness and transparency: process data on a valid basis, fairly, and with appropriate information for people.
- Purpose limitation: collect data for specified, explicit and legitimate purposes and assess whether later use is compatible with them.
- Data minimisation: limit collection to what is necessary for the purposes.
- Accuracy: keep data accurate and, where necessary, up to date.
- Storage limitation: keep identifiable data no longer than necessary for its purposes, subject to applicable requirements.
- Integrity and confidentiality: protect data with appropriate security.
- Accountability: take responsibility for compliance and be able to demonstrate it.
Article 5(2) makes accountability more than an assertion: an organization needs records and practices that support its ability to demonstrate compliance. A filled-in inventory or assessment is useful evidence only to the extent it is accurate, maintained and connected to the organization’s actual processing.
#1 Best Overall
Identify processing and its lawful basis
For each relevant processing activity, the organization needs to understand what personal data it uses, why, how it moves, who receives it, and how long it is retained. Article 6 sets out the lawful bases for processing; the appropriate basis must be assessed for the particular purpose and circumstances rather than selected as a generic software setting. Organizations also need to understand their roles and responsibilities, including where another party processes data on their behalf.
Give people required information and handle their rights
Article 12 governs transparent communication and the handling of requests under the data-subject rights provisions. The European Commission says information to individuals should be concise and transparent, intelligible and accessible, and written in clear and plain language, subject to the regulation’s exceptions. A functioning rights process needs to receive requests, route them to the people who can locate and assess relevant data, and document the response. The rights that apply and how a request must be handled depend on the circumstances and the regulation.
Maintain records, security and incident processes
Article 30 addresses records of processing activities. Article 32 covers appropriate technical and organisational security measures. Articles 33 and 34 address personal-data breach notification to supervisory authorities and communication to affected individuals, respectively, where the relevant conditions apply. These are related but distinct responsibilities: a processing record does not itself provide security, detect a breach or satisfy a notification duty.
Article 30 contains provisions and exceptions that can affect whether and how a record is required. Do not assume that every organization has identical record-keeping duties, or that generating a record in a platform is enough. The record needs to reflect real processing and be kept usable as that processing changes.
Assess high-risk processing
Article 35 requires a data protection impact assessment (DPIA) before processing likely to result in a high risk to individuals’ rights and freedoms. Whether a DPIA is required depends on the processing and applicable criteria; it is not a universal form to complete for every project. A privacy impact assessment (PIA) may be used as a broader organizational process, but it should not be treated as interchangeable with the GDPR’s DPIA requirement without checking the scope and legal criteria.
How do OneTrust and TrustArc describe their GDPR workflows?
The following is a comparison of the vendors’ own public descriptions, not an independent feature test. It shows areas each says its platform supports; it does not verify implementation quality, accuracy, usability or outcomes.
| Workflow area | OneTrust’s description | TrustArc’s description |
|---|---|---|
| Readiness and risk assessment | Describes GDPR readiness assessments and remediation plans. | Describes a risk profile that reviews variables and recommends assessments. |
| Processing inventory and data mapping | Describes a processing inventory and a live Record of Processing Activities (RoPA). | Describes Data Mapping & Risk Manager for recording personal-data processing, as well as inventories and data-flow maps. |
| Privacy assessments | Describes automated DPIA and PIA workflows. | Describes privacy assessments that include PIAs, DPIAs and vendor risk. |
| Individual rights requests | Describes data-subject request fulfillment. | Describes Individual Rights Manager workflows and data-subject request support. |
| Consent and preferences | Describes consent management. | Describes consent preferences. |
These are product claims, not proof that either platform will meet a particular organization’s legal or operational needs. The public descriptions do not establish comparable pricing, independent implementation outcomes or a controlled feature benchmark.
Recommended Free Tools
How should you evaluate a platform for your GDPR program?
Run both vendors through the same realistic scenarios using your organization’s processes and data. Assess the work that the tool enables and the evidence it leaves behind, rather than relying on a feature label or demonstration alone.
- Inventory and data flows: Can the team find and document relevant processing? How are records updated when systems, purposes, data categories or recipients change?
- RoPA quality: Can each record be traced to the underlying activity and its owners? Can the organization produce, review and export records in a form useful for audit and governance?
- DPIA and PIA lifecycle: How are assessments initiated, risk reviewed, approvals recorded, reassessment triggered and supporting evidence retained? Can the workflow distinguish a GDPR DPIA from other privacy assessments?
- Rights requests: Demonstrate intake, identity checks, routing to data holders, deadline tracking, decision-making and closure evidence using a representative request. Confirm how exceptions or complex cases are handled by your team.
- Consent and downstream systems: If consent is relevant to your processing, show how preferences are captured and communicated to the systems that need to act on them.
- Processors, integrations and governance: Test vendor or processor assessments, integrations and reporting against your actual environment. Clarify who owns data quality, configuration, approvals and ongoing administration.
- Implementation and operating fit: Establish what implementation work, support, deployment requirements and internal staffing are needed. Compare total cost for your organization’s scale and intended scope; the cited public descriptions do not provide comparable current prices.
Set acceptance criteria before demonstrations, then score the same scenarios against them. Include the people who will maintain the inventory and workflows, not only procurement or privacy leadership. A platform’s ability to store evidence is valuable only if the organization can keep that evidence accurate and act on it.
Which platform fits your organization?
There is no evidence here to declare OneTrust or TrustArc the objectively better, cheaper or more complete option. The useful choice is the platform whose demonstrated workflows, implementation demands and ongoing operating model fit the organization’s actual processing and compliance program. Confirm current product scope, terms and jurisdictional availability directly with each vendor, and have qualified privacy or legal personnel assess the organization’s obligations against the GDPR and its circumstances.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
