Tool directory: GDPR-compliant tools for your SMB

Enterprise password manager with EU hosting and GDPR DPA

1Password Business is a zero-knowledge password and secrets manager built for teams, with an admin console offering granular permissions. For German SMBs it pairs strong security architecture with practical compliance options: an EU data residency option and SOC 2 Type II certification. A DPA and SCCs are provided in 1Password's contract bundle, so an AV-Vertrag is available. The underlying residency is classified EU/US, meaning the EU option must be actively chosen and a transfer-risk assessment may still apply depending on configuration. It fits service firms, retailers and law practices that want to eliminate weak and reused passwords across the team while keeping admin oversight.

Data

EU + US (DPF)

DPA

Available

Security awareness training and phishing simulation platform

KnowBe4 Security Awareness is one of the largest security awareness training and phishing simulation platforms, with German-language content available. For DACH organisations it is increasingly relevant because it includes a NIS2 compliance module, supporting the awareness obligations many companies now face. An EU data region is available and a DPA is provided, so the processor relationship can be documented and data kept in the EU when configured. The underlying residency is classified EU/US, so the EU region must be selected and a transfer-risk view applied. It fits service firms, retailers, healthcare and law practices that need to train staff against phishing and evidence their awareness programme.

Data

EU + US (DPF)

DPA

Available

EU-made endpoint security with central cloud management

ESET PROTECT is multi-layered endpoint security with central cloud management, developed by ESET, an EU company headquartered in Slovakia. For German SMBs this matters: the vendor and the cloud management data both sit within the EU, avoiding the third-country questions that come with US security suites. A DPA (AV-Vertrag) is provided for all business tiers, and cloud management data is processed within the EU. There is no free tier for the business product, and like most endpoint tools it is not designed for processing special-category data. It is a solid choice for service firms, retailers, healthcare practices and law offices that want EU-made protection with one central console.

Data

EU only

DPA

Available

Made-in-Germany endpoint security for SMBs

G DATA Antivirus Business is German-developed antivirus and next-generation threat protection. Its defining feature for DACH buyers is that R&D and data centers are both in Bochum, Germany — the product is developed and operated entirely in Germany, giving the strongest possible answer to data-location questions. An AV-Vertrag is standard for all business contracts, so the processor relationship is documented out of the box. There is no free tier for the business edition, and as an endpoint tool it is not designed to process special-category data. It is well suited to service firms, retailers, healthcare practices and accounting offices that prioritise a made-in-Germany supply chain and full domestic data residency.

Data

EU only

DPA

Available