Tool directory: GDPR-compliant tools for your SMB

EU consent management platform — GDPR, ePrivacy, IAB TCF 2.2

Usercentrics CMP is a consent management platform from Munich that handles GDPR, ePrivacy and IAB TCF 2.2 requirements. It auto-blocks tracking scripts before consent is given and supports Google Consent Mode v2, which makes it a practical fit for DACH websites that run analytics or advertising. Data is held in Germany, and an AV-Vertrag is signed automatically on account creation, so the processor relationship is in place from the start. There is no free tier. As a consent layer it does not itself process special-category data. It is well suited to service firms, retailers, healthcare practices and law offices that need a defensible, EU-hosted cookie-consent solution.

Data

EU only

DPA

Available

GDPR-first digital patient communication for German medical practices

Doctorbox is a GDPR-first digital patient-communication tool for German medical practices. It offers secure messaging, digital intake forms, and document exchange between patients and practices — built specifically to replace non-compliant fax communication. Developed in Germany with data held in the EU, it is designed around DSGVO from the ground up. Because it carries Art. 9 DSGVO health data, it is suitable for patient information only with a signed AV-Vertrag and proper safeguards; an AV-Vertrag is included. The service is subscription-based with no free tier and is well suited to practices and IT teams modernising how they exchange sensitive documents.

Data

EU only

DPA

Available

AI-powered contract management software — GDPR-native, hosted in Germany

ContractHero is AI-powered contract management software that extracts, analyses and manages all company contracts. It is Berlin-based and hosts data in German Hetzner data centers, making it a GDPR-native option for DACH organisations. A GDPR DPA (AV-Vertrag) is signed at signup, and the company is SOC 2 Type II certified, with ISO 27001 in progress. The AI features help surface key terms, deadlines and renewal dates across a contract portfolio. For legal teams, professional-services firms and accounting practices that want automated contract intelligence without leaving German hosting, ContractHero is a compelling, compliance-forward choice. It is subscription-based with no free tier.

Data

EU only

DPA

Available

Swiss legally-binding e-signature — ZertES, eIDAS, and GDPR compliant

Skribble is a Swiss e-signature service providing qualified electronic signatures (QES) that comply with Swiss ZertES and EU eIDAS. Data is stored in Switzerland and a GDPR DPA is available. Skribble is popular for real estate contracts and lease agreements, where legally binding signatures are essential. A free tier covers two documents per month. For DACH businesses that need cross-border legal validity under both ZertES and eIDAS — without a US-based signing provider — Skribble delivers Swiss-hosted, standards-compliant signatures.

Data

EU only

DPA

Available

Open-source event ticketing — GDPR-first, self-hostable, EU-hosted SaaS

pretix is an open-source event ticketing and registration platform from Mannheim, designed GDPR-first. You can self-host it for full data control, or use the EU-hosted SaaS with data stored in Germany. It is privacy-by-design: there are no tracking pixels, and a consent layer is built in. A data-processing agreement (AV-Vertrag) is available, and a free tier lowers the entry barrier. For event producers who take attendee-data protection seriously — conferences, associations, public-sector events — pretix is one of the cleanest options on the market, especially in the self-hosted configuration.

Data

EU only

DPA

Available