Choosing GDPR compliance software for a company in France starts with the work your organisation actually performs. A record of processing activities, data protection impact assessments, processor relationships, rights requests and incidents are different workflows. The CNIL publishes guidance and free materials for several of them; it does not require a particular commercial platform. A useful purchase test is whether the software helps your team maintain accurate French-language evidence, find missing decisions and show how a conclusion was approved. A long feature list or a vendor’s claim of “CNIL compliance” cannot answer that test.
This company-authored buyer guide should be used as a set of procurement questions, not an independent vendor ranking. The suppliers below are candidates to verify, not a finding that one satisfies every French requirement. Features, hosting arrangements and prices can change; obtain the current scope in writing and test it with your data. For a broader selection method beyond France, see the GDPR software buyer’s guide.
What is specifically French about the evaluation?
The GDPR is the central EU framework. France also has the amended Informatique et Libertés law, CNIL doctrine and sector rules that can matter to a particular processing activity. None of those creates a duty to buy French software. What changes the buying exercise is the evidence your team must produce for French operations and the people who will review it. A DPO, HR owner, counsel, processor and CNIL investigator may need to understand the same processing in French, with dates, responsibilities and supporting documents visible.
The CNIL’s record-of-processing guidance explains the Article 30 record and offers a free model. It distinguishes a controller’s record from a processor’s record and expects the description to reflect the real activity: purpose, categories of people and data, recipients, retention and security measures. Software should make updates easier, not substitute a prefilled generic line for a real inventory. A small organisation can start with the CNIL template; the small-entity exemption in Article 30(5) is conditional, so “under 250 staff” is not by itself a reason to omit a record.
The CNIL also publishes DPIA materials, including a free PIA tool and methodology. An analyse d’impact relative à la protection des données (AIPD) is required when processing is likely to present a high risk under Article 35, with the CNIL lists and European criteria informing the assessment. It is not required for every HR system merely because the organisation is in France. Look for a way to record the decision that no DPIA was required as well as the risk analysis, measures and residual-risk consultation route when one is. The broader DPIA process is a legal judgment; a template only structures it.
Language is an operational criterion. Ask to see French labels, exported records, notices and assessment reports, then give the output to a person who was not involved in configuration. Can they see what was decided, by whom and when? An English-only interface may be workable for an international team, but a French legal export can matter if French owners must validate it. Do not assume that a French vendor, EU data centre or translated interface automatically makes the processing lawful.
Define the job before inviting vendors
Write down the three to five recurring tasks that cost your team the most time or produce the weakest evidence. Common examples are collecting facts for a registre, reviewing a new use of employee data, obtaining processor contract information, coordinating a request for access, and deciding whether an incident requires notification. For each task, identify the current owner, inputs, decision, record, reviewer and output. That sequence gives a realistic acceptance test and prevents a polished demo from hiding a missing approval step.
A processing record is not simply a list of applications. One HR platform may support recruitment, payroll and employee monitoring, with different purposes, bases and retention rules. Conversely, one processing activity may span several applications and processors. Ask whether the tool can represent those relationships without duplicating contradictory entries. Our Article 30 ROPA software guide gives a more detailed record test; its purpose is to help you assess structure and maintenance, not to make a particular vendor mandatory.
For a DPIA, test how the software moves from a description of the proposed activity to risks for people, proposed measures, residual risk and an approval decision. Ask whether the team can revisit an earlier DPIA when the scale, data source or technology changes. A checkbox saying “DPIA complete” is weak evidence if the underlying analysis cannot be inspected. For processor agreements under Article 28, test whether contract, instructions, subprocessor changes and review notes stay attached to the correct activity.
For rights requests and incidents, use realistic scenarios. The GDPR normally allows one month for a response to a rights request, with a possible extension of up to two further months under Article 12(3) and notice of the extension within the first month. A useful workflow records the request, identity-check reasoning, systems consulted, decision, response and any refusal reasons and remedies under Article 12(4). A personal-data breach needs a different assessment: Article 33 notification to the authority unless risk is unlikely, without undue delay and, where feasible, within 72 hours after awareness; Article 34 communication to people depends on high risk and exceptions. A timer alone cannot make either decision. See the breach-notification guide for the threshold and sequence.
A five-part proof-of-concept
Prepare one realistic but synthetic processing activity that involves a French controller, an external processor, two applications and a retention question. Give every vendor the same facts and the same time to configure. First, ask them to create the controller record and show what is missing. Next, change the purpose and have them explain how the existing notice, contract and DPIA assessment are flagged for review. Third, make a rights request and inspect the audit trail. Fourth, record an incident with uncertain risk and see whether the tool allows a reasoned “not yet notified” decision rather than forcing an answer. Finally, export the file in French for an independent reviewer.
Score what you can observe. Could a nonadministrator find the latest approved purpose? Does the export identify its source, owner and date? Can a reviewer reject an assumption and send it back? Can records be segmented between legal entities without exposing another controller’s data? Can you get your data out if the relationship ends? These questions are more durable than a claimed percentage of automation. The GDPR audit methodology provides a way to sample evidence after setup.
Include an edge case. A processor may serve several controllers, a deletion request may leave legally required accounting records, and a DPIA can reveal a high residual risk requiring Article 36 consultation before the processing begins. Ask the vendor to demonstrate how exceptions are explained and approved. If a system silently closes every request or emits a green badge after a questionnaire, record the gap; the problem is not that automation exists but that the accountable decision is invisible.
Which product category is the right starting point?
A free spreadsheet or the CNIL’s own materials can work when the number of activities is manageable and owners update them consistently. A dedicated privacy-operations platform becomes more valuable when facts must be reused across records, assessments, processor reviews, incidents and rights requests, or when several entities need separated permissions. A consent management platform (CMP) addresses cookie and preference choices on digital properties; it does not by itself maintain the whole GDPR programme. A security-compliance tool may manage controls and audits well while leaving the Article 30 record or rights workflow to another system. Define the gap before buying a wider suite.
Examples worth inviting to the same proof-of-concept include Dastra, whose current public site describes records, DPIAs, rights requests and incident reporting; Data Legal Drive, whose help centre documents records, PIA workflows and rights; and OneTrust Privacy Operations, whose current product page describes data mapping, assessments and incidents. Those are vendor descriptions, not independent verification of completeness, service quality, country of hosting or price. Ask each to demonstrate the French workflow, export and contract terms in your selected edition.
Didomi describes a CMP and preference-management tools; its developer documentation also describes a privacy-request module. If cookies and marketing choices are your main gap, compare this category directly with the consent-platform comparison. If your main gap is the controller record, a CMP demo should not displace the ROPA test. Ask every candidate to show how records, applications, processor relationships, assessments, incidents and rights requests connect, what a reviewer must approve, and how the resulting evidence can be exported. Check the current product scope and French-language output in a demo rather than inferring them from a category label.
The best GDPR software overview can supply additional names, but apply the same test rather than importing any publisher’s rank as a procurement conclusion. A vendor can be suitable for a multinational group and excessive for a small French team, or strong at consent and weak at processor governance. Company size alone does not tell you which records and decisions are difficult.
Data location, transfers and security
Ask where data are stored, where support staff can access them, which subprocessors are involved and how changes are communicated. EU hosting is useful information, but it does not automatically remove the need to examine third-country access or all transfer questions. Nor is a non-EU supplier automatically unlawful. Identify the real flow and, where Chapter V GDPR applies, the transfer mechanism and any supplementary measures. The Schrems II measures guide helps structure that separate assessment.
Security questions should be tied to the sensitive content you will place in the platform. A DPIA may describe vulnerable people and unmitigated risks; a rights request can contain an identity document; an incident record can expose system weaknesses. Ask about access control, separation of entities, audit logs, backup and restoration, encryption, deletion at contract end and incident assistance. Request evidence that covers the service and hosting arrangement being offered, then let your security team review exceptions. A badge or a data-centre location is one input, not a GDPR verdict.
Procurement should also decide who will own the data after rollout. If the privacy team cannot export readable records and supporting evidence, migration can become expensive even when licence fees look modest. Test a real export and reimport before signing, including attachments and approval history. A broad contractual right to retrieve information is only as useful as the format and operational support behind it.
Compare complete cost without invented price bands
Ask each supplier for a written first-year and renewal quote covering the same number of entities, users, activities and modules. Separate licence, setup, migration, training, integration, support, storage, additional entities, security review and exit assistance. Ask what happens when you add a subsidiary or a processor record. A low initial subscription can be outweighed by the configuration labour you must provide; a higher quote may include services that another vendor treats as extras. The EU GDPR software pricing guide lists cost components, but your negotiated quote governs this decision.
Do not use unsupported “typical” market ranges or assume a fixed number of manual hours saved. Instead, measure a baseline in your team: time to update one record, prepare one DPIA, answer one request and gather evidence for one audit. Repeat the same work in a trial. Count reviewer time as well as data-entry time, and record quality defects found. The result may justify the purchase through faster maintenance and fewer omissions, or show that a free template remains adequate. A fine avoided is not a sound ROI input because enforcement outcomes depend on facts and jurisdiction. The GDPR fines guide explains the legal framework without predicting a buyer’s exposure.
Build an exit cost into the comparison. Can the organisation retain its record and evidence in a usable form, and how long will it take to remove accounts and data from the vendor? Ask for a contract clause and a test, not just a slide. If an implementation partner supplies French legal templates, identify who updates them when law or CNIL guidance changes. “Included templates” is not a perpetual guarantee of correctness.
Make a decision and assign ownership
Select the tool that passes your real workflows with an acceptable total cost and manageable residual gaps. Record any manual control that remains: perhaps the DPO reviews high-risk DPIAs outside the platform, or an existing CMP handles cookies. Assign a business owner for the record, a technical owner for integrations and a reviewer for legal assumptions. Schedule a sample review after the first data import so duplicate purposes, missing processors and stale retention periods do not become institutional facts.
The DPO remains an adviser and monitor under Articles 38 and 39, not a software feature. Article 37 determines when designation is mandatory; it is not triggered merely because a company operates in France. See the DPO designation guide. The controller must remain able to explain its own decisions. Good software makes that explanation easier to assemble and inspect; it cannot make the decision on the controller’s behalf.
For a multinational buyer, compare the French workflow with other jurisdictions without assuming identical local expectations. The guides for Italy, Poland and Switzerland provide separate market starting points. A group-wide platform can work if it lets local teams capture the evidence their activity actually requires.
Questions buyers ask
Does the CNIL require a particular software product?
No. The GDPR requires appropriate records, assessments and decisions where applicable, and the CNIL supplies free guidance and tools. Choose software if it improves the completeness, maintenance and availability of evidence for your activities.
Must the supplier or hosting be French?
There is no general GDPR rule requiring a French vendor. Assess actual data flows, access, subprocessors, transfer rules, security and contractual controls. French-language output is an operational requirement to test with the people who will use and review it, not a nationality test.
How much should a French company budget?
There is no reliable universal price by employee band. Obtain comparable written quotes for the same scope, then add implementation, internal review, integrations and exit costs. Measure a trial against your current work rather than relying on advertised savings.
Can software replace a DPO or a DPIA decision?
No. A platform can collect information, structure review and preserve evidence. The controller decides whether a DPIA is required, what risks remain and whether consultation is needed; the DPO advises and monitors within the role required by Articles 38 and 39.