Legiscope and OneTrust should be compared against the work your privacy team must complete: maintaining a processing register, handling requests, documenting incidents and producing evidence. Shortlist Legiscope when its documented, controller-scoped records fit those requirements. Evaluate OneTrust when its advertised privacy automation capabilities address additional needs, then confirm the exact package and configuration. Neither conclusion follows from company headcount alone.
Disclosure: Legiscope is our product. This comparison uses our documented product scope and official OneTrust pages consulted on 8 September 2026. It is a procurement guide, not a claim of an independent hands-on benchmark. Prices, implementation duration and customer results require evidence from the actual proposal and pilot.
Start with a requirement sheet
Write down the tasks your team performs, the records involved and the people who approve the result. Separate essential requirements from useful additions. A team that needs a reliable register and authorised exports has a different buying problem from one that needs connected retrieval and deletion across many operational systems. Calling both needs GDPR software hides that difference.
For each requirement, record the current process, expected output, volume, responsible organisation and acceptance criterion. Include a difficult case, such as a request involving two systems or an activity shared by several controllers. Ask both vendors to demonstrate the same case with synthetic information. This produces comparable evidence without sharing real customer files during early sales discussions.
What the public product descriptions establish
| Area | Legiscope documented scope | What to verify in the procurement process |
|---|---|---|
| Processing register | Maintain Article 30 activities, identify missing required information and export authorised records. | Can the selected offer represent your controllers and preserve the required information in exports? |
| Application inventory | Connect applications with activities, a compatible processor relationship and evidence. | How are systems discovered or entered, and what ongoing maintenance remains with your team? |
| Processor relationships | Browse and reference authorised relationships in their operational context. | Which contractual review tasks are actually supported and who makes the legal decision? |
| Incidents | Record facts, customer decisions, response work and supported notification drafts. | What is guidance, what is an internal status and what, if anything, is actually transmitted? |
| Rights requests | Maintain request facts, basic timing, linked activities and source material. | Which steps of identity verification, retrieval, redaction, dispatch and confirmation are demonstrated? |
| Audits | Human checklist conclusions linked to supporting sources. | Does completion remain distinct from a compliant conclusion, and can the original evidence be retrieved? |
These Legiscope descriptions are supported by the public processing-register, application, processor, incident, rights and audit pages. They do not establish inclusion in every commercial offer; confirm the applicable scope in writing.
OneTrust describes data mapping and privacy assessment capabilities in its Privacy Operations offering. Its DSR Automation page describes request automation. Its GDPR solution discusses related compliance workflows. Treat these as vendor descriptions to verify against the package, data sources and configuration proposed to you.
Examine the processing register in detail
For Legiscope, the documented register includes activity information, deterministic identification of missing required fields and exports in supported PDF, DOCX and CSV formats. Shared activities can be associated with multiple controllers when the processing is genuinely the same. That capability is useful only if your organisation has defined when sharing is appropriate and when records need to differ.
In a demonstration, ask for one activity with missing retention information and another that belongs to a different controller. Observe whether the gap stays visible and whether an authorised export includes the correct scope. Then change a relevant fact and inspect the resulting record. A polished dashboard is less informative than evidence that the register remains accurate after an ordinary change.
Use the same acceptance criteria with OneTrust. Ask how the proposed configuration collects information, distinguishes assets from activities, validates completeness and creates an output your team can actually use. Do not assume that discovering a system proves every legal fact about the processing it supports. Someone still needs to establish purposes, roles and other facts from reliable information.
Separate a rights register from request fulfilment
Legiscope’s published rights scope is a register with request facts, basic elapsed-time information, links to activities and supporting material. It does not claim a complete legal deadline engine or automatic identity verification, response drafting, dispatch or delivery tracking. A closed record therefore cannot by itself demonstrate that a request was fulfilled.
This boundary matters when comparing with a request-automation proposal. Ask each vendor to show the entire path that you require: intake, verification, searches, review, protection of third-party information, response and evidence of delivery. Record which steps are native, which depend on connected systems and which remain manual. Assess the proposed method for failed connections and requests that cannot be matched to an existing identifier.
The buying decision may favour a focused register when the team already has a dependable fulfilment process elsewhere. It may require additional demonstrated automation when manual searches across many sources are the actual bottleneck. Decide from the workflow and expected volume, not from whether both products display a requests menu.
Review incidents, assessments and evidence
Legiscope documents incident facts, response actions, customer decisions and supported notification drafts. Its relevant time signal uses recorded awareness and the applicable Article 33 context. Documents remain drafts; the platform does not claim to send notifications. Ask the presenter to distinguish a recommendation, a recorded customer decision and evidence that an external communication actually occurred.
For audits, the documented workflow uses an explicit human conclusion for each checklist item. Attaching a file or completing a checklist does not certify compliance. In the pilot, inspect how the original source is preserved and how an unresolved conclusion appears after new evidence arrives. Avoid treating an AI summary as a substitute for the source document or the accountable reviewer.
For either vendor, assess any requested DPIA or transfer-assessment workflow separately. A general assessment label does not establish a particular legal methodology, approval process or suitability for your project. Define the required sections, review roles and export, then ask for the exact offered implementation. Unconfirmed capabilities remain procurement questions rather than assumed advantages.
Build the first-year cost comparison
Compare written offers with the same scope. OneTrust publishes pricing and packaging information; obtain a quote for the package and usage relevant to your organisation. Consult Legiscope pricing and request confirmation of the proposed terms. This guide does not infer a universal price or savings percentage from unrelated packages.
Your worksheet should contain subscription, included modules, usage limits, initial setup, migration, integrations, training, support and exit assistance. Add the internal time needed for data preparation, validation and ongoing ownership. Record whether a cost is fixed, estimated or dependent on an unresolved assumption. Keep taxes and currency treatment consistent when comparing totals.
A useful calculation is first-year external charges plus estimated internal effort at a rate chosen by your organisation. Show recurring years separately. If one quote excludes a required connection or migration task, add the missing work before comparing. A lower starting subscription can still leave more work with the customer; a broader package may include capabilities that your team has no reason to buy.
Check hosting, transfers and contractual roles
Ask for the actual processing locations, support access, subprocessors and relevant contractual documents for the chosen offer. Distinguish storage location from remote access and onward processing. Neither a vendor’s nationality nor an EU storage option establishes every fact about international transfers.
For Legiscope, use the public trust information as an entry point to the applicable documents and confirm their contractual version. Request equivalent evidence from OneTrust. Compare security responsibilities, incident assistance, deletion, access restrictions and changes to subprocessors. Do not infer contractual approval from the presence of a processor relationship in either product.
Evaluate the evidence proportionately. A certificate or report can be relevant, but check its entity, service, scope, date and exclusions. Avoid a simple certificate count. Your decision needs to address the information and operations that will actually be entrusted to the service.
Run a bounded migration pilot
Choose a representative set of records with synthetic or appropriately anonymised information. Include an incomplete activity, a linked application, a request, an incident and supporting files where those workflows are required. Agree what must survive export and import: references, dates, attachments, controller allocation and conclusions.
Assign the customer tasks as well as the vendor tasks. Someone must decide which old records are duplicates, which assumptions are unsupported and which historical attachments can be retained. Importing an inaccurate spreadsheet faster does not make the result reliable. Record manual corrections and configuration decisions so that the full migration can be estimated from observed work.
Set a rollback point before switching the operating team. Verify the new records and required exports, keep an authorised copy of what must be preserved and confirm the old provider’s exit process. The pilot should produce a decision and a concrete implementation scope, not an unsupported promise that every deployment takes the same number of days.
A hypothetical purchasing decision
Consider a fictional group with two controllers, an existing request-handling process and a poorly maintained processing register. Its essential criteria are scoped records, visible missing information, evidence attachment and usable exports. The group demonstrates these tasks in both offers and records manual steps. It does not award points for capabilities unrelated to those requirements.
If the demonstrated Legiscope scope satisfies those criteria and the commercial and contractual terms are acceptable, it can remain on the shortlist. If the group instead needs connected request fulfilment across several sources, it must compare the additional workflow against OneTrust’s proposed configuration and any other suitable options. The outcome changes with the actual requirement; this example reports no customer result or measured product superiority.
Questions to settle before signing
Ask which capabilities are included in the order, which require configuration and which are only planned. Confirm who maintains the underlying data and who makes legal decisions. Request an export that a colleague can understand without the salesperson’s explanation. Identify the conditions for changing users, controllers, modules and usage during the contract.
Finally, write the reason for your choice in operational terms: required output, demonstrated result, remaining work and accepted commercial conditions. Keep unknowns visible. If a critical requirement remains unproven, continue the evaluation before committing. To review Legiscope against your own requirement sheet, book a demonstration using the same scenario you will present to other vendors.