A customer emails your shop asking you to delete her data. Customer service can close her account, marketing can remove her newsletter profile, and finance needs to keep her invoices. If one person can coordinate those steps and show what happened, a spreadsheet may serve you well. If everyone assumes someone else replied, you have a specific reason to buy software.
Start with CNIL’s free register template if one person can keep it current and your team can reliably handle privacy requests. Dedicated GDPR compliance software for SMEs in France becomes worth paying for when several departments need to assign work, restrict access, meet deadlines, or reconstruct a decision. If your main difficulty is deciding what you may legally keep, look for an offer that includes access to a privacy adviser.
On French vendor websites, look for RGPD, short for Règlement général sur la protection des données. It is the French abbreviation for GDPR. France’s data protection authority, the CNIL, publishes a free registre des traitements, or record of processing activities. It makes a useful starting point even if you eventually buy a platform.
When is CNIL’s free template enough?
Try completing one entry before booking a demo. Choose a familiar activity such as payroll. Ask HR why it collects employee data, which categories of information it uses, who receives them, how long it keeps them, and whether any data goes outside the European Economic Area. Record the relevant safeguards and give someone responsibility for updating the entry when the payroll provider changes. A useful register describes the activity. It has no need for employees’ individual salaries or bank details.
A small business with one shop, a stable set of suppliers, and an identified privacy lead may manage with that template, a restricted request log, and calendar reminders. Test the arrangement during a colleague’s absence. Can their cover find the latest register, identify an open request, and see when a reply is due without searching the colleague’s inbox?
Headcount alone is a poor buying rule. The GDPR exemption from certain record-keeping duties for organisations with fewer than 250 employees is limited. Regular processing such as payroll falls outside the exemption because it is ongoing. Risky processing and certain sensitive data also affect the analysis. A small employer can therefore need a register while having little reason to pay for a platform. To map where staff information travels, start with the handoffs between recruitment, payroll, and leave described in our guide to HR software.
What does GDPR software cost a small team in France?
These published prices were checked on 14 November 2026. French quotes commonly use hors taxes (HT) for prices excluding VAT and toutes taxes comprises (TTC) for prices including it. The products below use different billing units, so give each vendor your headcount, number of legal entities, and expected users before requesting a written quote.
| Option | Published price in euros | What the price covers or assumes |
|---|---|---|
| CNIL register template | €0 | Downloadable starting point. Your team maintains the records and arranges reminders and access controls. |
| RGPD Facile by DATIVO, Essentielle | €95/month HT with a 12-month commitment, or €114/month HT without commitment | Per French legal entity, identified by its SIREN. Unlimited users and processing activities. The annual commitment costs €1,140 HT, equivalent to €114/month TTC at the vendor’s displayed rate. |
| Data Comply One | Solo from €190, Coach from €230, Externalisé from €290/month HT | Entry prices shown for a business with fewer than 15 employees and a 12-month commitment. Headcount affects the quote. Platform users are unlimited. |
| Witik RGPD | €240/month for the displayed one-entity SME configuration | Annual payment and a 36-month commitment. At an unchanged base rate, that is €2,880 a year or €8,640 over the term. Earlier vendor pricing labelled the figure HT. Confirm VAT on the current quote. |
RGPD Facile for a team that can maintain its own records
RGPD Facile is a practical shortlist choice when HR, IT, and operations all need access within one legal entity. Essentielle includes the processing register, individual rights requests, processor records, incidents, and data protection impact assessments. You can give each department responsibility for its entries and appoint an internal reviewer without budgeting for another seat. A second company with its own SIREN needs a separate subscription. rgpdfacile
The higher Intégrale tier starts at €165/month HT on a 12-month commitment. Its main addition is an AI assistant. A business buying the tool for its register and rights workflow can therefore start with Essentielle. The published tariff does not specify a fee for importing an old spreadsheet or having an adviser review it. Request those as separate quote items if your first register needs substantial work.
Data Comply One for a business deciding how much advice to buy
Data Comply One makes the distinction between software and professional help relatively easy to budget. With Solo, your staff maintain the register and handle requests. Coach adds access to a data protection officer (DPO) for guidance. Externalisé adds a dedicated outsourced role and assistance during a regulatory inspection. The platform lists French and English among its interface languages. Its rights module includes deadline alerts, editable replies, and a request history.
Consider Coach if an operations manager can gather the facts but needs help deciding what to do with them. Before paying for Externalisé, ask who interviews department heads, enters their answers, and follows up on missing information. Agree on onboarding work, included advisory time, and the price of additional work. Unlimited user accounts settle the seat question. They tell you little about how much expert time you are buying.
Witik for teams coordinating work across departments
Witik’s one-entity configuration brings together the register, impact assessments, rights requests, and incident records. It suits a team with an internal privacy lead who wants department owners to act on outstanding tasks. The current pricing page says its former free plan has been replaced by startup assistance and describes personalised onboarding. Ask the vendor to scope spreadsheet migration and confirm contributor-seat limits in writing.
The configurator lists an online DPO option at an additional €200. Request an itemised quote showing its billing frequency, included advice, and who will maintain your records. The three-year term matters if you expect to sell a subsidiary, change systems, or bring privacy work in-house. A shorter commitment or monthly payment can carry a surcharge.
Follow the data beyond the hosting location
Ask the vendor to trace a single customer request. Where does it store the form, send the acknowledgement email, keep the backup, and display the support ticket? Which legal entity performs each task, and from which countries can its staff access the information? A French hosting address answers only the first part of that enquiry.
RGPD Facile illustrates why the feature settings matter. DATIVO says it hosts data in France with OVHcloud. If a customer enables the optional AI assistant, content submitted to it is processed by Anthropic in the United States. The assistant is off by default. Witik and Data Comply One also describe French hosting. Ask each provider for the current list of subprocessors covering the features you intend to enable.
Request the data processing agreement and check how the vendor announces new subprocessors. For transfers outside the European Economic Area, ask which legal mechanism covers the specific recipient. That might be an applicable adequacy decision or standard contractual clauses with an assessment and any necessary safeguards. Have the vendor identify the mechanism for your configuration in writing. Keep the answer with the contract so a future colleague can review it when a supplier changes.
A retailer’s deletion request, from inbox to reply
Suppose a Lyon homeware shop receives this email: “Please delete my account and everything you hold about me.” Use this fictional case during a demo. It tests whether the software helps employees reach and explain a decision across several systems.
- Log the request on receipt. Customer service records the date, the customer’s wording, a contact reference, and the response deadline. The operations manager owns the case and names a deputy. The normal deadline is one month from receipt. An extension of up to two further months can apply where necessary because of complexity or request volume. The customer must hear about the extension and its reason within the first month.
- Check identity proportionately. A request through an authenticated account may give the shop enough assurance. If the email comes from an unfamiliar address and there is reasonable doubt, ask for the minimum additional information needed. A passport scan creates another sensitive document to protect.
- Give each system an owner. E-commerce checks the account and saved addresses. Marketing checks the mailing platform. Finance checks invoices. If orders also flow into an ERP, include that system in the search. Closing the storefront account alone leaves the team unable to explain what happened downstream. Read our ERP software guide illustrates how business systems share data.
- Decide what to erase and what to retain. The shop removes eligible profile and marketing information. Finance documents its obligation to retain invoices, which CNIL gives as a ten-year example. Limit access to the retained documents and record when retention ends. Notify recipients of the erasure where required, unless doing so is impossible or involves disproportionate effort.
- Reply and close the case. Tell the customer which records were erased, which remain, why, and for how long. For any part refused, explain the reason and the available complaint and judicial remedies. Save the dated response and enough evidence to show who completed each action. Set a retention period for the case itself so an erasure request does not create an indefinite copy of the customer’s history.
Vendor demo checklist
Give each vendor the same fictional request and a redacted register entry. Let the employee who will use the system operate it in French.
- Import a register entry. Bring over a purpose, supplier, retention period, and owner. See what happens when a required value is missing.
- Test two permission levels. Can a shop manager complete a task while an unrelated HR case stays private?
- Hand over an open request. Reassign it during an owner’s absence and check that the original deadline and case history survive.
- Try the French experience end to end. Read the staff menus, customer acknowledgement, and final reply. Ask a support question in French and confirm support hours for your plan.
- Export your work. Open the exported register and closed case outside the platform. Check that dates, decisions, and attachments are understandable after cancellation.
- Price the first year and the full term. Include migration, extra entities, seats, training, advisory hours, optional AI, VAT, and renewal conditions. Ask the vendor to mark each item as included or separately priced.
FAQs
Does every French SME need a DPO?
No. The obligation depends on the organisation and its activities. For example, core activities involving large-scale, regular and systematic monitoring, or large-scale processing of certain sensitive data, can trigger the requirement. An SME can still appoint an internal privacy contact to coordinate records and requests. A formal DPO appointment carries specific responsibilities.
Can a cookie banner handle our GDPR obligations?
A banner addresses a narrower task. It can help manage choices about website trackers. Your payroll register, supplier agreements, retention decisions, and customer erasure requests still need owners. Check which functions a subscription includes before buying a product marketed broadly as an “RGPD solution.”
Should we upload our customer database during a trial?
A fictional customer and a redacted register entry are enough to test assignment, deadlines, permissions, and exports. If a vendor proposes a live integration, first agree on which fields it will copy, who can access them, and how the vendor will erase trial data if you walk away.
Final words
Take your last privacy request into the buying decision. If the delay came from finding the right colleague, prioritise ownership, reminders, and handover. Everyone knew their task but nobody could decide what to retain, budget for advice. If your team handled the request on time and can explain its decision from the records it already keeps, CNIL’s template may still be the right choice.