Compliance Software Cannot Make You Compliant — And Buying It Once Raises a Question Worth Asking

Every vendor in this category is selling you the same implied promise, and almost none of them say it out loud: buy this and you will be compliant.

None of them can deliver it. What they can deliver is narrower, genuinely useful, and worth paying for — and the distinction matters more here than in any other software category, because getting it wrong has a regulator on the other end.

The line

What software can actually do:

• Count days. A request arrived on the 3rd; the duty says thirty days; the deadline is the 2nd. That is arithmetic.
• Keep a record. Who asked, when, what was done, by whom, and when it closed — in a form you can export and hand over.
• Prompt somebody. Before the deadline, not after.
• Enforce a workflow. So a request cannot quietly sit in an inbox nobody owns.

What software cannot do:

• Decide whether your response was legally sufficient.
• Know what your regulator expects of your sector.
• Notice that the law changed.

The first list is a records-and-timers problem. The second is a professional-judgment problem. Any vendor blurring them is selling you a feeling, and you should read their disclaimer before their feature list.

Credit where it is due: three products that say so themselves

We read three self-hosted compliance tools' own FAQs on 1 August 2026. All three refuse the implied promise in the first answer:

Privara — "Does this make me GDPR-compliant?" — "No — it helps you meet the deadline and maintain an auditable record of every request; whether your responses are legally sufficient is your responsibility and depends on your jurisdiction and the specifics."

Complia — "Does this make me DUAA-compliant?" — "No tool can claim that. Complia implements the record-keeping and acknowledgement mechanics the duty describes; your policies, responses, and legal position are yours."

Safora (food safety) — "Is this a legal guarantee of compliance?" — "No, and any tool claiming that should worry you."

"Any tool claiming that should worry you" is the correct instinct for buying in this category, and it applies to hosted vendors just as much — Enzuzo, Osano, Whistlelink and FaceUp are subject to exactly the same limit.

The question a one-time license has to answer

Here is the uncomfortable part, and we would rather raise it than have you discover it.

Most software we sell has stable logic. A rota is a rota; the arithmetic of who works Thursday does not change when a parliament sits. A one-time license fits that perfectly.

Compliance tools are different: some of their logic is legislated, and legislation moves. If a duty's acknowledgment window changes from thirty days to forty-five, or a new field becomes mandatory, a tool you bought once needs an update to stay correct — and "12 months of updates" answers a security question, not a legal one.

So ask any vendor in this category — including us — two things:

1. Which parts of the product encode a legal rule (a deadline length, a required field, a retention period), and which parts are just record-keeping?
2. What happens when that rule changes? Who tells you, and what does the update cost?

This is the single most useful question in this whole article, and almost nobody asks it at purchase.

Why these particular tools survive it reasonably well

Look at what each one actually encodes:

• Privara tracks "Six: access, deletion, rectification, portability, objection and restriction of processing (Article 18)" with deadline tracking and an audit log. The rights and the deadline are the legislated parts; the portal and the log are not.
• Complia runs "an acknowledgement timer and audit CSV export", shipped set to 29 days — one inside the statutory 30, because s.164A(3) counts the day of receipt. The 30 is the legislated part. The timer, the register and the export are not.
• Confida does "anonymous case codes and EU Directive 2019/1937 SLA tracking." The SLA durations are legislated; the case handling is not.

In each case the legislated surface is small and numeric — a count of days, a list of request types. That is the best possible shape for a one-time purchase in a moving legal area: when the number changes, the change is a configuration or a small update, not a re-architecture.

*A tool that instead claims to encode legal judgment* — to tell you whether a response is adequate — would be both more impressive and far more dangerous.** None of these do.

The most honest thing we found in the category

Complia's FAQ does something we have not seen another vendor do: it dates the legislation, states the commencement position, and tells the reader to go and check it themselves.

"The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and S.I. 2026/82 reg. 3(a) brought the complaints-handling duty in s.103 fully into force on 19 June 2026 — it now sits in s.164A of the Data Protection Act 2018. Check legislation.gov.uk and ico.org.uk before publishing your own compliance dates."

A compliance vendor pointing you at the primary source rather than asking you to trust its summary is the behavior you should look for. And you should do it — commencement dates move, and a vendor's page is not the statute.

What the hosted options cost

Note Enzuzo's unit: ten DSARs a month. For most small organizations that is generous; for one having a bad quarter it is a cap, and caps are where hosted pricing surprises people. And the tier below it is free, with three a month (read 5 September 2026) — worth saying on a page arguing that this category oversells itself: for an organization receiving a handful of requests a year, the cheapest honest answer is somebody else's free tier, not our license.

Against those, the self-hosted registers are $79 (Privara), $79 (Complia) and $119 (Confida), one time (product pages, read 2026-08-20) — or all six compliance registers together in the Compliance Suite.

One product detail worth reading before buying anonymity

Confida makes a trade-off that most whistleblowing vendors would hide, and states it plainly:

"A reporter lost their case code or passphrase — can we recover it?" — "No — there's no account and no email, so there's no reset; that's the trade-off for storing no identity fields, and it's stated clearly on the 'save these' screen."

That is what real anonymity costs, and a vendor who offers both perfect anonymity and password recovery is offering one of them falsely. Decide whether your reporters can live with it before you deploy it, because you will not be able to help them afterward.

Who should self-host compliance registers

Yes if: you are a small organization with a real but low-volume duty — a handful of DSARs a year, a whistleblowing channel of the kind Directive (EU) 2019/1937 Article 8(3) attaches to private-sector entities with 50 or more workers (Article 8(4) disapplies that threshold for the sectors in Parts I.B and II of its Annex), a complaints register to be produced on request. The record is the deliverable, and a one-time register produces it.

Yes, particularly, for whistleblowing: a report that never leaves your infrastructure is a materially different privacy posture, and the free incumbent in that space (GlobaLeaks) is built for media organizations and NGOs handling high-risk disclosures rather than for a company's standard HR compliance channel — a good project aimed at a different job.

No if: you need legal advice, sector-specific certification support, or a vendor who will stand behind your regulatory position. Buy a platform with a compliance team, or hire an adviser. Software is not either of those.

No if: you have not asked the update question above and got an answer you are happy with.

The honest costs

The record is the point, so backups are the obligation. If a regulator asks for your complaints register and you cannot produce it, "the server failed" is not a defense.

Deadline alerts must actually fire. Monitor the cron. A missed thirty-day acknowledgment is the exact failure the tool was bought to prevent.

You still own the legal judgment. Every one of these products says so; we are repeating it because it is the thing people forget by month three.

Hosting. All run on ordinary shared hosting. For a concrete number from a named provider: Hetzner's own pricing — machine-read on 10 August 2026 from the price API behind its web-hosting and cloud pricing pages — lists web-hosting plans from €1.60 to €16.72 a month and entry cloud servers from €3.99 a month (prices as returned for their German datacenters; confirm current pricing and VAT treatment at checkout). Any comparable host works — the point is that the "own" side of this comparison costs single-digit euros a month.

The short version

Compliance software counts days and keeps records. It does not know the law and it cannot vouch for your answers — and the three self-hosted tools we read all say so in their own first FAQ answer, which is the right instinct.

Before buying anything in this category, ask which parts encode a legal rule and what happens when that rule changes. The tools that survive that question are the ones whose legislated surface is a number — a deadline, a list of rights — rather than a judgment.

And if a vendor tells you their product makes you compliant, believe the one that told you it cannot.

Next steps

• Privara — self-hosted GDPR DSAR portal · demo — the DSAR portal, at length
• Confida — self-hosted whistleblowing portal · demo — is a shared inbox enough for the Directive?
• Self-hosted compliance tools
• The SaaS Price Observatory — where quote-gated vendors are recorded as quote-gated

Try the Privara demo ↗Live, on sample data, no sign-up.

This article is about software, not law. Nothing here is legal advice, and commencement dates and duties change — check the primary source for your jurisdiction, as one of the vendors quoted above explicitly tells its own customers to do.