GRC software for data protection & data governance:
44 providers with AI classification.

What sets data protection software apart from data governance tools?

The difference lies in the subject: data protection software documents the processing of personal data, while data governance covers the data itself. Data protection software, often called a privacy management system, keeps the record of processing activities (RoPA), data protection impact assessments (DPIAs), processors, data subject requests and personal data breaches. Data governance, by contrast, records which data sits where and where it flows. Seven providers apply AI exactly there, detecting and classifying personal and sensitive data in structured data stores and in files. Some link this to handling access and erasure requests.

• No specific AI function in the sources checked: 2 entries
• Only announced or in-development functions: 1 entry
• Documented AI use cases by topic, an entry can count more than once: Record of processing activities (16) · Assessing privacy risks (15) · Data protection impact assessments (10) · Drafting privacy documents (9) · Data subject requests (4)
• Documented headquarters in Europe: 23 of 44 providers, headquarters not separately checked: 12

Questions for the demo, derived from the five criteria of the comparison:

• Do the record of processing activities, the data protection impact assessment and the deletion concept draw on the same systems and owners?
• Who reviews an AI draft of an impact assessment before it takes effect, and where is a rejection recorded?

When is a data protection impact assessment mandatory?

Before processing that, in particular where new technologies are used, is likely to result in a high risk to the rights and freedoms of natural persons; one assessment may address a set of similar processing operations with similar high risks (Art. 35(1) GDPR). It is expressly required, for example, for a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based (Art. 35(3)(a)). Supervisory authorities publish lists of operations that require one (Art. 35(4)), and a designated data protection officer must be consulted (Art. 35(2)).

May the money laundering reporting officer also be the data protection officer?

As a rule, no. MaRisk does allow the compliance function to be combined with other suitable functions, such as the money laundering reporting officer or the data protection officer. The explanatory note to AT 4.4.2 para. 3 (Circular 06/2026), however, refers to section 3.2 of the interpretation and application guidance on the German Money Laundering Act, under which these two roles may not, as a rule, be combined.

What must the record of processing activities contain?

Art. 30(1) GDPR sets the minimum content: name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer, the purposes, the categories of data subjects and of personal data, the categories of recipients, any transfers to a third country or an international organisation and, where possible, erasure time limits and a general description of the technical and organisational security measures referred to in Art. 32(1). The record is kept in writing, which includes electronic form, and made available to the supervisory authority on request (Art. 30(3) and (4)).

Which providers of GRC software for data protection & data governance are headquartered in Germany, Austria or Switzerland?

Of the 44 providers, nine have a documented headquarters in Germany, Austria or Switzerland: in Germany AIGOY, audatis, caralegal Data Responsibility Platform, DataGuard, heyData, preeco and Proliance; in Austria Schindler IT Solutions; in Switzerland Priverion. For twelve further providers, the headquarters has not been checked separately; they are not included in this list. Headquarters means the seat of the provider entity named in the entry, documented by the entry's location source (imprint, legal texts, official contact and company pages, occasionally official registers); it says nothing about ownership, hosting or data storage.

Regulatory framework.

• Art. 30 GDPR (Regulation (EU) 2016/679): minimum content of the record of processing activities, made available to the supervisory authority on request (Source: EUR-Lex)
• Art. 35 GDPR: data protection impact assessment before processing likely to result in a high risk, with typical cases and minimum content (Source: EUR-Lex)
• Art. 12 and 15 to 22 GDPR: data subject rights; information on action taken without undue delay and in any event within one month of receipt of the request; extendable by two further months only where necessary given the complexity and number of requests, with the data subject informed of the extension within one month (Art. 12(3)) (Source: EUR-Lex)
• MaRisk AT 4.4.2 para. 3 with explanatory note, BaFin Circular 06/2026 (BA): compliance function may be combined with the data protection officer, money laundering officer and data protection officer kept apart as a rule (Source: BaFin, in German)

Further reading on t-nex.de: Retention periods for bank records, EU AI Act for banks and MaRisk 2026.