Framework
The General Data Protection Regulation requires you to process personal data lawfully and to be able to demonstrate this at any time. Complass guides you step by step from clarifying roles to evidence towards the supervisory authority.
This framework is also available on its own with a fixed scope: also as an individual package
The GDPR is Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data. It has applied directly in all Member States since 25 May 2018 and requires, among other things, a legal basis for every processing activity, transparent information, fulfilment of data subject rights, appropriate security and the notification of data breaches.
Content as of:
The GDPR applies to every company that processes personal data, regardless of size and sector: data of employees, applicants, customers, contact persons and website visitors. It covers processing in the context of an establishment in the EU and offers to persons in the EU from outside.
Many obligations also apply to processors, i.e. service providers who process data on behalf of others. Whether a data protection officer must be designated depends on the activity and on national law.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Roles and data protection organisation, record, legal bases, data subject rights, processing on behalf and third countries, TOMs and deletion concept, impact assessment, data breaches, and operation and evidence.
Every obligation from Art. 5 to Art. 49 with applicability, status and evidence, plus a catalogue of measures under Art. 32, linkable with ISO 27001 and NIS2.
Including record of processing activities, legal-basis matrix, privacy notices, data subject request process, DPA checklist, transfer assessment, TOMs, deletion concept, DPIA and data breach register.
You use assets, risks, suppliers and document control jointly for data protection and information security.
For day-to-day operations: you keep records, processors, TOMs, impact assessments and data subject requests as a register with deadlines and exports in the privacy operations module. More about privacy operations
Catalogue: Obligations under the GDPR
Records of processing activities, processors, TOMs, data protection impact assessment and data subject requests with the one-month deadline in one register.
Learn moreClassify suppliers, request self-assessments and evidence directly from the supplier, review them and ask for more. With questionnaires for NIS2, GDPR, ISO 27001, the CRA and IEC 62443-2-4.
Learn moreRecord incidents, check reporting obligations under NIS2, the CRA and the GDPR and track the reporting deadlines with a countdown.
Learn moreThe GDPR is included as baseline protection in every Complass plan. A larger plan adds further modules.
The GDPR is included as baseline protection in every Complass plan, from Start at €179 net/month.
With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 16 October 2026.
Adjust the selection in the price overview: minimum selection GDPR
Business
More impact with Risk management and Business continuity management (BCM), room for 10 users and 2 frameworks.
€449 net/month, €270 more than the minimum selection.
With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 16 October 2026.
Good to know: You can also meet the obligations without Complass. Complass supports you with implementation and evidence but does not replace legal advice. Legal information
No. Complass structures implementation and evidence; advice and monitoring remain the task of the data protection officer where one is designated. The content does not replace legal advice.
No. Complass helps with assessment, content and documentation of the notification; you submit the notification via your supervisory authority’s reporting channel.
Yes. The content follows the Regulation, which applies in all Member States. German specifics from the BDSG are marked as national notes; you check national rules of other Member States yourself.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
