GDPR compliance software for the EU GDPR and the UK GDPR

Compliance has separate catalogs for the EU GDPR of 2016 and the UK GDPR of 2021. You adopt the one that applies to you, or both, and each one is its own framework.

The UK GDPR is the GDPR as kept in UK law after Brexit, read together with the Data Protection Act 2018. The UK GDPR catalog includes the changes from the Data (Use and Access) Act 2025 that were in force when the catalog was written, such as the duty to handle data protection complaints.

The catalog marks each requirement as mandatory or optional. Mandatory requirements include Art. 5, Art. 6, the data subject rights in Art. 12 to 21, Art. 28, Art. 30, Art. 32 and Art. 33. Requirements that apply only in some situations are marked optional, such as the DPIA in Art. 35, the data protection officer in Art. 37 to 39 and the transfers in Chapter V. You decide whether they apply to you.

You cover Art. 30 on records of processing with your policies, procedures, assets and evidence.

In Dutch, the EU GDPR catalog shows the official AVG text from EUR-Lex. In English, it shows summaries in plain language. National laws such as the Dutch Uitvoeringswet AVG are not in the catalogs.

Compliance does not certify your organisation. Coverage in Compliance is your working record of the requirements and the evidence for them. You and your legal adviser decide what the GDPR asks of your organisation. This page is not legal advice.

In the Incidents register you mark an incident as a personal data breach under Art. 33. You record when you became aware of the breach and when you reported it to the supervisory authority. The incident shows a 72 hour breach clock for Art. 33 and warns you when the report is overdue. You make the report to the authority yourself.

You can filter the incident list to personal data breaches.

In the Suppliers register you mark the suppliers that process personal data. SubProcessor is one of the supplier categories. The default supplier review checks the processor contract under Art. 28(3), and you file the data processing agreement as an attachment on the supplier.

The crosswalk marks each link between frameworks as Equivalent, Partial or Related. Evidence, findings and register records can meet requirements in several frameworks.

The closest overlap for the GDPR is with the Privacy criteria of SOC 2. The crosswalk marks the data subject rights in GDPR Art. 15 to 18, Art. 20 and Art. 21 as equivalent to SOC 2 P5.1 and P5.2. It also marks Art. 13 and 14 as equivalent to P1.1, and Art. 5(1)(e) on storage limitation as equivalent to P4.2 and P4.3. The Privacy criteria are optional in SOC 2, so this overlap matters only if your SOC 2 examination includes Privacy.

The links to ISO 27001 are partial or related. The crosswalk marks GDPR Art. 32 and ISO 27001 A.5.34 on privacy and protection of personal data as partial. Art. 28 on processors relates to the supplier controls A.5.19, A.5.20 and A.5.22.

One access control record, for example, can meet requirements in GDPR Art. 32, ISO 27001 A.5.15 and SOC 2 CC6.1. The crosswalk marks A.5.15 and CC6.1 as equivalent. Art. 32 covers the security of processing as a whole, so the crosswalk marks it as related to both.

Under Frameworks, Proposed coverage suggests matches from the crosswalk once you cover the source requirement. You accept or dismiss each suggestion, and Compliance applies none of them on its own.

Each audit covers its own framework. A supplier review covers one supplier.

Compliance has registers for policies, procedures, risks, assets, suppliers, incidents, evidence and findings, among others. The registers are shared between the frameworks you adopt, so the GDPR and ISO 27001 use the same records.

Compliance scores each risk on a 5×5 likelihood and impact matrix. Treatment actions lower the residual risk score.

Compliance creates recurring review tasks for policies, risks, assets and requirements on schedule. Every task has an owner and a due date, and all tasks appear in one inbox.

Compliance also has an AI assistant on every page. It runs on AI credits, billed in USD, and it is not part of the trial unless you buy AI credits.

The data processing agreement and the list of subprocessors for Compliance, including the AI assistant, are published at mvdm.io/legal.

Michiel van der Meer built Compliance after taking over an ISMS at Jewel and seeing how much hand-work it took. He needed a better solution, so he built one.

The EU GDPR is €199 per framework per year, excl. VAT. The UK GDPR is a separate framework at the same price. Each includes $5 of AI credit per year, billed in USD, and you can buy extra credits. Users in your organisation are unlimited.

You pay for each framework you adopt separately. If you adopt the EU GDPR and the UK GDPR, each one is €199 a year, excl. VAT. ISO 27001 is €999 per framework per year, excl. VAT.

Try Compliance for 30 days without a credit card. The trial gives you full access to every framework. The AI assistant is not part of the trial unless you buy AI credits.

See all Compliance pricing →