GDPR 2026: 8 Free Starter Tools for SMEs

Which GDPR obligation does which tool cover?

Free tools mainly cover documentation and information obligations: the record of processing activities under Art. 30(1) GDPR, the information obligations under Art. 13 and Art. 14 GDPR, the consent question for cookies and the preparation of a personal data breach notification under Art. 33(1) GDPR. What templates cannot deliver — the assessment decisions — is set out at the end under 'Where free tools reach their limits'.

The following overview assigns each obligation to its provision. Column 2 states the provision from which the obligation follows; column 3 is the editorial team's practical assessment and not a legal consequence.

On the sequence: first the RoPA (no. 2), then personal data breaches (no. 5 and no. 8), then the DPA (no. 8), then training (no tool in this list) — a practical recommendation, not a statutory order. Like the supervisory authorities' review sequence, it starts with the record of processing activities; their further steps (DPA, TOM, DPIA) deviate from this order (practical assessment). The fourth stage, training, has a statutory anchor where a data protection officer has been designated: Art. 39(1) GDPR assigns to that officer the task of informing and advising (point (a)) as well as monitoring compliance, including awareness-raising and training of staff involved (point (b)). Without a designated data protection officer, step 4 remains an organisational decision: the obvious content, on a practical assessment, is the topics to which deadlines attach in this article — the notification route for a Personal Data Breach (Art. 33(1) GDPR) and the handling of data subject requests (Art. 12(3) GDPR); record content, date and participants so that delivery remains demonstrable as part of Accountability (Art. 5(2) GDPR).

1. GDPR self-test in 8 questions

The self-test is a position check, not compliance with an obligation. 8 questions online, without registration. Score with an individual recommendation of measures; the result can be saved as a PDF using the browser's print function. Start here.

Its value lies in prioritisation: you see which obligations are open before you invest time in individual tools. Two questions should be clarified regardless of the score, because separate obligations attach to them. First: do you process special categories of personal data under Art. 9(1) GDPR — including health data, genetic and biometric data for unique identification, trade union membership? These are subject to a general prohibition on processing with narrow exemptions. Second: is one of your processing operations likely to result in a high risk and therefore trigger a data protection impact assessment under Art. 35(1) GDPR? In Germany, the second question additionally triggers the obligation to designate a data protection officer irrespective of the number of employees (§ 38(1) sentence 2 BDSG).

2. Set up the RoPA yourself as an Excel spreadsheet

The record of all processing activities under Art. 30(1) GDPR can be kept without specialist software as your own spreadsheet (Excel/CSV) — on form, see below. 9 columns: 7 mandatory items under Art. 30(1)(a) to (g) GDPR plus 2 practical fields (split of point (c), legal basis). A RoPA template in Excel including example processing activities is included in the GDPR Kit.

The column logic behind it: Art. 30(1) GDPR lists seven mandatory items (points (a) to (g)). Because (c) bundles two points — categories of data subjects and categories of personal data — practice derives eight fields per processing activity from this. The legal basis under Art. 6(1) GDPR is added as a ninth field; it is not named in Art. 30(1), but follows from Accountability (Art. 5(2) GDPR).

1. Name and contact details of the controller (and, where designated, of the data protection officer)
2. Purposes of the processing
3. Categories of data subjects
4. Categories of personal data
5. Categories of recipients
6. Third Country transfers including documented safeguards
7. Envisaged erasure periods
8. General description of the technical and organisational measures — as a reference to the central TOM concept (Art. 32 GDPR)
9. Legal basis (practical field, Art. 6(1) GDPR)

If you are a Data Processor, the shorter catalogue in Art. 30(2) GDPR applies with four items (points (a) to (d)), including the general description of the measures under Art. 32(1) GDPR.

The exemption in Art. 30(5) GDPR applies only cumulatively: fewer than 250 employees and no risk to the rights and freedoms of data subjects and no regular processing and no special categories under Art. 9 or criminal-law data. The official wording refers to 'a risk', not a high risk — the 'high risk' threshold does not belong to Art. 30(5) but to other provisions, such as the DPIA (Art. 35(1) GDPR) and the communication to data subjects (Art. 34(1) GDPR). On form: the record must be in writing, including in electronic form (Art. 30(3) GDPR) — an Excel spreadsheet is such a form. On a practical assessment, no particular tool is required beyond that as long as content, currency and readability are right; an editable format (Excel/CSV) is preferable to a PDF. On a practical assessment, dedicated tools only become worthwhile from around 50 processing activities or with multi-site structures. The record must be made available to the supervisory authority on request (Art. 30(4) GDPR).

3. Privacy notice generator

Generators supply the raw text for the information obligations under Art. 13 and Art. 14 GDPR — they do not map it to your actual processing operations. Free generators are offered by chambers of commerce and consumer bodies among others — this article does not name a specific free offering reviewed by us; check your chamber's offering against the following list of criteria. Adaptation is required in any case — this section is therefore a selection and comparison guide, not a source of supply.

The criteria list before use (practical recommendation):

1. The generator covers the mandatory items under Art. 13(1) and (2) GDPR in full.
2. It leaves the individual items from your record of processing activities open as fields — categories of recipients, Third Country transfers including documented safeguards, envisaged erasure periods.
3. It outputs editable text, not a plain PDF — the notice must be capable of being updated with every change to the RoPA.
4. It allows the contact details of a data protection officer to be entered, if one has been designated.
5. It lets you choose the competent complaints body — in Germany the Land authority, in Austria the Austrian Data Protection Authority (Datenschutzbehörde).

The comparison after the generator run: for every processing activity kept under no. 2, the purpose, legal basis, recipients, any Third Country transfer with a safeguard and the erasure period must be found again in the notice. The legal areas diverge when it comes to the reference to the right to lodge a complaint: in Austria the Austrian Data Protection Authority (Datenschutzbehörde) must be named (Art. 13(2)(d) GDPR); there is no separate national provision there, the information obligations follow directly from Art. 13 and Art. 14 GDPR. In Germany, the Land authority competent for you must be named; the delimitation of competence is set out under no. 5.

4. Study the DSK fine catalogue

The fine catalogue on datenschutzkonferenz-online.de makes German fining practice transparent; the statutory framework is set by Art. 83 GDPR.

You need both tiers of the framework in order to classify. Infringements of obligations such as the record of processing activities, processing on behalf of a controller or notification duties (among others Art. 25 to 39 GDPR) are subject to up to EUR 10,000,000 or 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4) GDPR). Infringements of the principles of processing and the conditions for consent (Art. 5, 6, 7 and 9 GDPR) as well as of data subject rights (Art. 12 to 22 GDPR) are subject to up to EUR 20,000,000 or 4 % (Art. 83(5) GDPR). In addition, in Germany § 43 BDSG makes the incorrect handling of a request for access as well as consumer information under § 30 BDSG a regulatory offence subject to a fine; the fine is up to EUR 50,000 (§ 43(2) BDSG), and no fines are imposed on authorities and other public bodies (§ 43(3) BDSG). In addition to Art. 83 GDPR, § 62(1) DSG in Austria provides for administrative fines of up to EUR 50,000 for certain offences — for example intentional unlawful access to a data processing operation or intentional transmission in breach of data secrecy (§ 6 DSG) — provided the act does not already constitute an offence under Art. 83 GDPR; the Austrian Data Protection Authority (Datenschutzbehörde) is competent (§ 62(5) DSG). Under § 11 DSG, Art. 83 GDPR is to be applied proportionately, in particular by issuing a reprimand instead of a fine for first-time infringements. How to use the catalogue: assign the points left open from no. 1 and no. 2 to the two tiers — documentation and organisational obligations (among others Art. 25 to 39 GDPR) to the tier under Art. 83(4), principles of processing and consent (Art. 5, 6, 7 and 9 GDPR) as well as data subject rights (Art. 12 to 22 GDPR) to the tier under Art. 83(5). Record the assignment for each open point in writing — tier, provision concerned and status date — so that the prioritisation remains traceable. To gauge the order of magnitude, the Fine Calculator is available in the tools block below; a fine amount for your individual case cannot be derived from it (see 'Where free tools reach their limits').

5. BfDI activity report 2025

The activity report is reading material on federal supervisory practice — it is not your notification route. bfdi.bund.de — reporting period 2025.

The difference matters in practice: the Federal Commissioner for Data Protection (BfDI) is competent for federal public bodies as well as for certain providers of telecommunications services (§ 9(1) BDSG). Companies as non-public bodies are subject to the authorities competent under Land law (§ 40(1) BDSG) — in Bavaria, for example, the Bavarian State Office for Data Protection Supervision (lda.bayern.de), while the Bavarian Data Protection Commissioner is competent for the public sector. A notification under Art. 33 GDPR therefore goes to the notification portal of the Land competent for you; in the case of cross-border processing, the lead supervisory authority is the addressee. Every Land operates its own notification portal — establish the portal and contact once and record both with a status date in the breach log, so that the route is fixed before the 72 hours start running. For the report itself, the detour via no. 2 is worthwhile: place your processing list next to it and search the report's table of contents for the topics that match the processing operations in your record.

For Austria: the DSK and the BfDI are German institutions. For Austrian businesses, the Austrian Data Protection Authority (Datenschutzbehörde, DSB) is competent — it is established under § 18(1) DSG as the national supervisory authority pursuant to Art. 51 GDPR; its activity report on dsb.gv.at is the counterpart to the BfDI report. A Personal Data Breach notification under Art. 33 GDPR also goes there to the Austrian Data Protection Authority (Datenschutzbehörde), not to a German body.

6. EDPB guidelines: the three SME topics and their statutory anchors

On a practical assessment, three topics are relevant for SMEs — cookies, Third Country transfers and consent — and, for the fines side, the calculation of administrative fines in addition. edpb.europa.eu — free guidance on cookies, Third Country and consent.

Each of these topics hangs on a specific provision, and without this assignment the reading remains without consequence. Cookies: § 25(1) TDDDG with the exemptions in subsection 2 (wording and review plan under no. 7), in Austria § 165 TKG 2021 — review step: assign every tool embedded on your website to one of the two categories, requiring consent or not. Third Country: transfers to a Third Country must be entered in the record of processing activities together with the documented appropriate safeguards — for controllers under Art. 30(1) GDPR, for processors under Art. 30(2)(c) GDPR; review step: for each Third Country recipient in the RoPA (no. 2), name the documented safeguard (SCC, DPF or BCR). Consent: where processing is based on consent, the controller must be able to demonstrate that consent was given (Art. 7(1) GDPR), and withdrawal must be as easy as giving consent (Art. 7(3) GDPR); review step: record for each processing operation how the demonstration is provided and by which route withdrawal runs. This section names one guideline by number: EDPB Guidelines 04/2022 on the calculation of administrative fines (EDPB) for the fines side. For the three SME topics it supplies the statutory anchors; you look for the matching guideline on edpb.europa.eu and compare it against the review step named in each case.

7. Test Pirsch Analytics

The trial clarifies the preliminary question of whether your web analytics needs consent at all. Free trial period, according to the provider's information as at the first version (2 May 2026) 14 days — check the duration and conditions with the provider before starting. Check whether cookieless analytics is enough for you.

In Germany, § 25(1) TDDDG is decisive: the storage of information in the end user's terminal equipment or access to information already stored is permitted only if the end user has consented on the basis of clear and comprehensive information; information and consent are governed by the GDPR. No consent is required if the sole purpose is to carry out the transmission of a message or if access is strictly necessary in order to provide a digital service expressly requested by the user (§ 25(2) TDDDG). In Austria, § 165 TKG 2021 is the parallel provision with an opt-in for tracking cookies. Irrespective of this, every processing of personal data needs a legal basis under Art. 6(1) GDPR — and web analytics belongs in the record of processing activities as a processing activity in its own right.

How to answer the preliminary question within the trial period:

1. Open a test page with the embedded tool in a fresh browser profile and check in the browser's developer tools under Application/Storage whether cookies, localStorage or sessionStorage are set or read.
2. File the finding with the date, the URL checked and a screenshot — Accountability under Art. 5(2) GDPR requires you to be able to demonstrate the classification.
3. Translate the finding into the consequence: no storage or access operation, then no consent under § 25(1) TDDDG is required; storage or access operation, then consent before the first access — beforehand, compare against the exemptions in § 25(2) TDDDG. The legal basis and the RoPA entry remain unaffected.

The trial is time-limited and clarifies the preliminary question once; the documented finding from step 2 supports the classification after the trial ends as well. Clarify the terms for ongoing operation with the provider before rollout.

8. Use the Compliance-Kit practical tools

The free tools on this site classify and prioritise; they do not generate document templates. compliance-kit.eu/tools offers five interactive tools, plus self-tests — for getting started with the GDPR, the relevant ones are the GDPR self-test, the Cookie Banner Audit, the GDPR Checklist and the Fine Calculator. Without registration.

The assignment of the four tools: the self-test sorts the sequence (no. 1), the GDPR Checklist checks the breadth, the Cookie Banner Audit the consent question (no. 7), and the Fine Calculator gauges the order of magnitude (no. 4). For the documents themselves, the statutory anchors remain: the record serves Art. 30 GDPR (details under no. 2). Personal Data Breach documentation addresses the notification obligation under Art. 33(1) GDPR and the documentation obligation under Art. 33(5) GDPR, which also applies to breaches that are not notified (deadlines see FAQ). The DPA must cover Art. 28(3) GDPR: the subject matter and duration of the processing, the nature and purpose, the type of personal data, the categories of data subjects and the obligations and rights of the controller must be set out in the contract. Upstream, Art. 28(1) GDPR requires you to work only with processors providing sufficient guarantees of appropriate technical and organisational measures. Templates for this are not free but are included in the GDPR Kit: RoPA template (Excel), DPA template, data breach response plan with a 72-hour notification form. Directly linked are the GDPR self-test, the Cookie Banner Audit, the GDPR Checklist and the Fine Calculator.

Where free tools reach their limits

Free tools supply documents and structure, but no assessment — and the assessment is something you must take responsibility for yourself. Whether a processing operation triggers a data protection impact assessment under Art. 35(1) GDPR, whether a breach is likely to result in a risk (Art. 33(1) GDPR) or means a high risk for the data subjects (Art. 34(1) GDPR) is decided by your company, not by the template. Four further limits, named honestly:

• Templates do not monitor deadlines. Keep the date of receipt and the due date in a calendar with a named responsibility that can be covered by a deputy — the deadlines for a Personal Data Breach (Art. 33(1) GDPR) and data subject requests (Art. 12(3) GDPR) are in the FAQ.
• The catalogue and the calculator classify, they do not forecast. A fine amount for your individual case cannot be derived from them; only the assignment of your open points to the two tiers is robust (no. 4).
• No tool designates a data protection officer. Check the thresholds whenever the number of employees and the types of processing change, and record the result with a date — DE/AT thresholds are in the FAQ.
• When the switch is due. On a practical assessment: from around 50 processing activities, with multi-site structures, with special categories under Art. 9(1) GDPR and with processing operations that trigger a DPIA under Art. 35(1) GDPR.

Effort and scaling are empirical values, not a legal consequence: 8 to 16 hours to get started, then around 1 hour of upkeep per week; from more than 250 employees onwards, a commercial solution becomes more efficient on this assessment. This empirical figure has nothing to do with the 250-employee threshold in Art. 30(5) GDPR — that concerns only the RoPA exemption and applies only cumulatively (see no. 2). Whether a service in a Third Country is embedded, by contrast, can be read directly from the record: if no data flows to a recipient in a Third Country, this entry remains empty; for processors, Art. 30(2)(c) GDPR expressly names it only 'where applicable'. Practice requires safeguards such as SCC, DPF or BCR only for Third Country recipients.