The CNIL does not only chase the giants anymore.
If you run a small or mid-sized company in France, that sentence is worth reading twice. The regulator has a simplified sanction procedure, created by the law of 24 January 2022, that allows fines of up to €20,000 and was designed to process cases from smaller organizations quickly. A spreadsheet that nobody has touched in two years is no longer a safe place to hide.
Most French SME owners I hear from are not trying to dodge the rules. They are trying to find the shortest honest path through them. Who needs a registre des traitements? Is the cookie banner enough? Do I need a DPO? And which of the dozen tools with “RGPD” in the name will actually help instead of adding another login?
This guide answers those questions and compares the main GDPR compliance software options in France for SMEs: Dastra, Legiscope, Witik, Leto, Axeptio, Didomi, OneTrust and a few others. You’ll get indicative prices, who each tool suits and a clear recommendation at the end.
Two honest disclosures. First, I haven’t run these tools inside a live compliance project for this piece. The comparison draws on published 2026 reviews, vendor documentation and CNIL guidance. Many French comparison sites are run by, or friendly with, the vendors they rank, so I’ve leaned on points that show up across several sources. Second, this is not legal advice. For anything high-risk, talk to a qualified DPO or a lawyer.
The Short Answer
- Most French SMEs (roughly 10 to 250 employees) that want one tool for the whole job: start with Dastra, and put Witik or Legiscope next to it in your trial.
- E-commerce or a website-heavy business where the cookie banner is the main headache: Axeptio for the banner, plus a lightweight registry tool or the CNIL’s free template.
- Publishers and ad-driven businesses where consent is a revenue question: Didomi.
- Large groups under many privacy laws: OneTrust. For a typical SME it is the wrong size.
- A tiny company with a handful of data processing activities: the CNIL’s free registry template is a legitimate place to start.
The sections below explain why, including the mistake that catches most SMEs: buying a cookie banner and thinking the job is done.
What GDPR Actually Asks of a French SME
Before you shop, get clear on what you’re shopping for. The regulation is long, but for an SME the day-to-day obligations boil down to a manageable list.
A registre des traitements. Article 30 asks for a record of your processing activities. Strictly, organizations under 250 employees can be exempt, but not if the processing is more than occasional, carries risk or involves sensitive data. Payroll, customer files and recruitment are regular processing, so in practice almost every SME needs one. The CNIL itself recommends that all organizations keep one and publishes a simplified model for small businesses.
A legal basis for each processing activity. Consent, contract, legal obligation, legitimate interest. This is one of the first things an inspector looks for.
Clear information for the people whose data you hold. Privacy notices on your website, in your contracts and in your recruitment process.
A way to handle rights requests. Access, deletion, rectification, objection. You generally have one month to respond, so you need a process before the first request lands.
Contracts with your processors. Every SaaS tool that touches personal data (your CRM, newsletter platform, payroll provider) needs a data processing agreement. This is the gap I see most often.
A breach procedure. Serious personal data breaches must be notified to the CNIL within 72 hours, and you should keep an internal log of all breaches.
Valid cookie consent. The CNIL’s rules say refusing must be as easy as accepting, and withdrawing consent must be as easy as giving it.
Impact assessments when needed. If a processing activity is likely to pose a high risk to individuals, you need a DPIA (AIPD in French) before you start.
A DPO or a named lead. A formal DPO is required in specific cases (public bodies, large-scale monitoring, large-scale sensitive data). Many SMEs don’t need one by law, but the CNIL still recommends designating someone to drive the work.
If your company also processes data for clients as a subcontractor, you’ll need a separate registry of those activities too.
Fines can reach €20 million or 4% of worldwide annual turnover, but for SMEs the realistic exposure is usually the smaller, faster penalties and the operational disruption of an inspection. The cost that rarely makes headlines is the lost deal: larger customers increasingly ask for proof of compliance before they sign.
Related Reading on Software Cora
What GDPR Compliance Software Can and Can’t Do
Let me be blunt. GDPR compliance software doesn’t make you compliant on its own. People and processes do. What software does is make compliance cheaper to maintain and easier to prove.
A good tool will give you guided forms for your registry, pre-filled legal bases and retention periods, a place to track processors and their contracts, workflows for rights requests, a breach log, DPIA templates, task reminders and exports you can hand to an inspector. A bad one gives you a nicer-looking spreadsheet.
And here’s the distinction most buyers miss. The market splits into three families that are not interchangeable:
Full compliance platforms (Dastra, Legiscope, Witik, Leto, OneTrust). They cover the registry, DPIAs, processors, rights requests and audits.
Consent management platforms, or CMPs (Axeptio, Didomi, Cookiebot). They run your cookie banner and consent records. They don’t build your registry or handle your DPIAs.
Specialist tools for rights requests, e-learning or AI governance. Useful, but narrow.
Comparing Axeptio to OneTrust is like comparing a door lock to a security company. Decide what you need first, then compare within the right family.
What to Look For as a French SME
Beyond the usual feature checklist, a few criteria matter more in France.
French language and CNIL alignment. Interface, templates and support in French, with registry fields that match CNIL expectations. This saves real time during an inspection.
Hosting in France or the EU. Most French vendors host in France or the EU. OneTrust offers regional choices. For many SMEs, and especially those selling to public bodies or regulated sectors, EU hosting is a procurement requirement, not a preference.
A registry that exports cleanly. If an inspector asks for your registre, you should be able to produce it in minutes.
Processor management. The ability to log each vendor, attach the DPA and flag missing contracts is where tools earn their keep.
Multi-client mode for external DPOs. If you use an outsourced DPO, check that the tool supports it. Some platforms are built for that workflow.
Price you can model. Several vendors quote privately. Ask for a number at your size, and ask what’s locked behind higher tiers.
Security credentials. Several of the main platforms advertise ISO 27001 certification. Ask to see current certificates rather than trusting a badge.
AI Act readiness, if relevant. Some platforms are adding inventories for AI systems alongside the GDPR toolkit. If you use or build AI, ask about it, and check where EU timelines currently stand, since they’ve been shifting.
The Platforms Compared
Prices below are indicative figures drawn from published 2026 comparisons. They vary between sources, they change often and they depend on company size and plan. Treat them as ranges to test, not quotes.
| Platform | Family | Best for | Indicative price | Watch out for |
| Dastra | Full platform | Tech-comfortable SMEs wanting a modern, broad tool | From about €79 to €500 per month depending on plan; a freemium entry exists | Learning curve; costs rise on advanced plans |
| Legiscope | Full platform | SMEs and external DPOs wanting a fast start | Roughly €100 to €400 per month | Less suited to groups with dozens of subsidiaries |
| Witik | Full platform | SMEs and e-commerce wanting an accessible interface and consent handling | Roughly €100 to €300 per month | Less depth on audits and processors |
| Leto | Full platform | SMEs wanting automation and multi-entity support | Check with vendor | Less independent comparison data available |
| Axeptio | CMP | Websites, e-commerce, small teams | Roughly €30 to €200 per month | Cookies only; not a compliance platform |
| Didomi | CMP and privacy suite | Publishers and ad-driven businesses | CMP roughly €50 to €500 per month; privacy suite from around €250 | Doesn’t cover registry or DPIA; pricey for small SMEs |
| OneTrust | Enterprise platform | Large international groups | On quote, often above €1,000 per month | Heavy and oversized for most SMEs |
Dastra
Dastra is a French platform that covers the full spectrum: registry, DPIAs, processors, rights requests and increasingly AI-related features. Reviewers praise its modern interface, open API, documentation and community, and one 2026 buying guide places its entry point around €79 per month, which makes it one of the more accessible full platforms. A freemium tier has also been mentioned.
The trade-offs: a learning curve, and prices that climb on advanced plans. It reads as a platform for teams with at least one person comfortable configuring software.
Pick it if: you’re an SME or growing mid-sized company with someone technical, you want one tool to grow into and you value French hosting and a solid registry module.
Skip it if: your needs are tiny or you want a hand-held, done-for-you service.
Legiscope
Legiscope pitches fast startup: AI-assisted audit and registry generation, quick rollout and legal support, with a particular fit for SMEs and external DPOs who manage several clients. Indicative pricing sits around €100 to €400 per month.
A caution: much of the favorable commentary about Legiscope comes from content the vendor publishes itself. That doesn’t make it wrong, it just means you should test the generated documents against the CNIL’s own models before trusting them.
Pick it if: you want to get to a working registry quickly or you’re an external DPO managing multiple clients.
Skip it if: you’re a group with a large number of subsidiaries.
Witik
Witik is positioned as a complete compliance platform with an accessible interface and good consent handling. It shows up in recommendations for SMEs, e-commerce businesses and even local authorities. The usual caveat applies: reviewers say it has less depth on audits and subcontractor management than the heaviest tools.
Pick it if: you’re an SME or online retailer that wants approachable, all-in-one compliance without a steep learning curve.
Skip it if: your processor landscape is large and complex.
Leto
Leto appears repeatedly in French recommendations for SMEs, praised for intuitive design, automation and multi-entity, multilingual setups. Independent detail is thinner than for Dastra or OneTrust, so request a demo and a trial with your own data before deciding.
Axeptio
Axeptio is a French consent management platform whose cookie banner gets consistent praise for user experience and easy installation. It’s often named as the most direct alternative to Didomi for SMEs and e-commerce, and indicative pricing runs from about €30 to €200 per month.
It handles cookies and consent records. It does not give you a registry, DPIAs or processor tracking.
Pick it if: your site’s cookie compliance is the main gap and you can handle the rest with a template or another tool.
Skip it if: you expect it to cover your entire GDPR obligation.
Didomi
Didomi is a French consent specialist, strong where consent is directly tied to revenue, such as publishers and advertisers. Its broader privacy suite adds modules like rights-request handling, with one source placing it from about €250 per month and noting it’s most valuable for SMEs and mid-sized companies handling many requests and needing a CMP at the same time.
For a small company without those needs, it’s more tool than you need.
Pick it if: consent and advertising compliance are central to your business model.
Skip it if: you’re a small SME that just needs a registry and a banner.
OneTrust
OneTrust is the American market leader in privacy technology, and it is genuinely powerful: multi-regulation coverage, deep modules and a large partner ecosystem. It’s also complex and expensive, with reviews describing deployments that take months and budgets that start in the tens of thousands of euros per year. One buying guide calls it oversized for companies under 1,000 employees.
Pick it if: you’re a large international group dealing with GDPR, CCPA and other regimes at scale.
Skip it if: you’re an SME. Truly.
Other Names You’ll See
Cookiebot (from Usercentrics) is a common consent option known for automatic scanning. Commanders Act is a French option for larger accounts and media. Captain DPO, Data Legal Drive and Privacil appear in several comparisons. For rights-request handling specifically, a handful of lighter tools exist at far lower prices than the big platforms, so if that is your only gap, look at them before buying a full suite.
Which GDPR Compliance Software for Which SME Situation
A 10-person company with simple data (customers, payroll, newsletter). Start with the CNIL’s free registry template in a spreadsheet, add a lightweight CMP if you have a website and move to software once you pass a few dozen processing records. One practitioner guide suggests switching to a SaaS tool somewhere around 50 entries, which feels about right.
A 30 to 100 person e-commerce business. Witik or Dastra for the platform, plus Axeptio if you want a best-in-class banner. Make sure the registry covers HR and marketing, not just the shop.
A 50 to 250 person B2B SaaS or services company that sells to large customers. Dastra or Legiscope. Customers will ask for your DPA, security answers and registry evidence, so choose a tool that produces them cleanly.
An accounting firm, agency or consultancy that handles client data as a processor. Make sure the tool supports the separate subcontractor registry. Dastra and Legiscope are worth testing.
A company using an outsourced DPO. Ask your DPO which platform they already run. Their familiarity beats any feature list.
A publisher or ad-driven site. Didomi, with the registry handled separately or inside the same suite.
A subsidiary of a multinational. You may be told to use the group’s OneTrust. Ask what’s mandatory and avoid paying for a second tool.
Related Reading on Software Cora
What It Costs
Budgets for GDPR compliance software in France vary, but here is a realistic frame for SMEs drawn from 2026 market guides.
A cookie banner on its own often lands in the tens of euros per month. A full compliance platform for an SME typically runs from around €100 to a few hundred euros per month. One vendor guide puts a typical annual software budget for a 10 to 250-person company at roughly €2,000 to €10,000, which matches the ranges above. Enterprise suites sit in a different universe.
Add the costs that don’t appear on the price page: the hours your team spends building the first registry, any external DPO or legal review, and training. For many SMEs, the people time costs more than the license. That’s the strongest argument for choosing a tool your team will actually enjoy using.
Do You Need a DPO?
Not always, and this surprises people.
A formal DPO appointment is mandatory in specific situations: public authorities, organizations whose core activities involve large-scale regular monitoring of individuals, and those handling sensitive data at large scale. A typical SME selling software or goods doesn’t automatically meet those tests.
That said, the CNIL recommends designating a pilot, and a named person with time and authority makes everything else easier. Outsourced DPOs are common for SMEs. If you go that route, your software choice should work for them too.
Your First 90 Days
A rollout that actually finishes follows a simple pattern.
Weeks 1 to 2: map what you hold. List the processing activities by team: sales, marketing, HR, finance, IT. A typical SME ends up with somewhere around 10 to 20. Don’t forget video surveillance, badge access and recruitment.
Weeks 2 to 4: build the registry and fix the biggest gaps. Record the purpose, data categories, legal basis, retention and recipients for each activity. Flag anything with no legal basis or no retention rule.
Weeks 4 to 6: sort out your processors. Make a list of every SaaS tool that touches personal data. Check each has a DPA. Chase the ones that don’t.
Weeks 6 to 8: handle the public face. Update privacy notices, put a compliant cookie banner in place and test it, including the refuse button.
Weeks 8 to 10: write the procedures. Rights-request handling, breach response, retention and deletion. One page each is plenty.
Weeks 10 to 12: train and test. Run a short staff briefing and one dry-run of a rights request and a breach. Then set a quarterly review.
If you’re choosing the wider stack at the same time, our Business Software guides and the primer on choosing business software without overspending will help you avoid duplicate tools.
Mistakes SMEs Make
Thinking the cookie banner is compliance. A compliant banner is necessary and nowhere near sufficient. It doesn’t give you a registry, processor contracts or a breach procedure.
Ignoring HR data. Payroll, recruitment, badge systems and surveillance are central to the registry and a frequent focus of CNIL cases involving employees.
Buying enterprise tools for SME problems. The heaviest platform is not the safest one. The tool people use is the safest one.
Skipping processor contracts. Your SaaS stack is full of data processors. Missing DPAs are the quiet gap behind many audit headaches.
Letting the registry rot. The CNIL expects the registry to be current on the day of an inspection. A beautiful registry from 2023 is worse than a plain one from last month.
Messy data underneath. If the same customer appears under three spellings across your systems, everything built on top gets harder. Our piece on normalizing messy brand data shows how that problem looks in practice and how to tame it.
Treating it as a one-off project. Compliance is a habit. Put a quarterly review on the calendar.
GDPR Software and AI Tools
More SMEs now use AI assistants, transcription tools and analytics that process personal data. Each is a processing activity that may need a registry entry, a legal basis, a DPA and sometimes an impact assessment.
Some compliance platforms are adding AI-system inventories, which can help you keep track. If you’re evaluating AI products, our AI Software section covers what’s worth trying. Keep an eye on how EU AI rules are phased in, as dates have been moving, and check current guidance before you commit to a timeline.
For tools that touch customer data, such as your CRM, see our CRM Software reviews, and for newsletter and consent-related tools, our Marketing Software section.
FAQs
What is the best GDPR compliance software in France for SMEs?
For most, Dastra. It covers the whole job at a price that suits an SME, and it’s built in France. Witik and Legiscope are strong alternatives, and Axeptio is the best fit if your only gap is the cookie banner.
Is a cookie banner enough for GDPR compliance?
No. A banner covers cookies and consent on your website. You still need a registry, privacy notices, processor contracts, a rights-request process and a breach procedure.
Do French SMEs have to keep a registre des traitements?
In practice, yes. The legal exemption for organizations under 250 employees doesn’t apply to regular processing, and payroll and customer files are regular. The CNIL recommends that all organizations keep one and publishes a simple model.
Can the CNIL fine a small company?
Yes. The simplified sanction procedure allows fines of up to €20,000 and was created to deal with smaller organizations more quickly. Full GDPR fines can reach €20 million or 4% of worldwide turnover.
Do I need a DPO for my SME?
Only in specific cases, such as large-scale monitoring or large-scale sensitive data. Many SMEs don’t, but the CNIL still recommends naming a lead, and an outsourced DPO is a common solution.
How much does GDPR software cost for a small business?
Roughly from a few tens of euros a month for a cookie banner to around €100 to €400 for a full platform, based on published 2026 comparisons. Always get a quote at your size.
Is OneTrust too big for a small business?
Almost always. It’s an enterprise platform with enterprise pricing and deployment effort. Unless you’re a large international group, a French or EU platform will serve you better.
Should I choose a French or EU vendor?
It isn’t legally required, but hosting in France or the EU simplifies procurement and customer conversations, particularly in regulated sectors.
Can I do GDPR compliance with just Excel?
For a very small company, yes, starting with the CNIL’s free model. Once your registry grows past a few dozen entries or several people need to work in it, software saves time and reduces mistakes.
How long does it take to become compliant?
For a typical SME, a focused 90-day effort gets the core in place: registry, notices, processor contracts, banner and procedures. Staying compliant takes regular reviews.
Does GDPR software cover the AI Act?
Some platforms are adding AI inventories, but coverage varies. Ask each vendor what’s available today, not what’s planned.
Final Thought
If I were choosing GDPR compliance software for a French SME with 10 to 250 employees, I’d run a two-week trial of Dastra and Witik, test Legiscope if I wanted the quickest start or worked with an external DPO, and choose Dastra unless the team preferred a simpler interface. I’d add Axeptio for the cookie banner if the website mattered. I would not touch OneTrust.
And whichever tool you pick, remember where the real risk sits. It’s rarely in the software. It’s in the missing processor contracts, the forgotten HR data and the registry nobody has opened since the last audit scare.
Ready to get started? Pick two platforms from this list, ask for a trial with your real processing activities and aim for a working registry in your first month. Then book a 90-day review. For more software comparisons, browse our Business Software and Productivity Software guides.
Write for Us
Do you test gadgets, build desk setups or explain tech in plain words? Write for SoftwareCora and share your ideas with readers who want honest, useful guides. Send us your guest post today →
2 Comments
Pingback: Hospitality Software France: Revenue Management 10-300
Pingback: Cloud Based CRM Software: Best Platforms & Buyer's Guide