DataGuard vs OneTrust

DataGuard

"Daten-Mapping & VVT" and "DSFA & Risikobewertungen" exist as feature names on the GDPR page, plus a template library with acknowledgements — but TOMs, legal bases, and any linkage between RoPA, DPIA and processors appear nowhere in seven captured pages. That is a feature glossary, not a data model; a structured register with a DPIA module and the rest outside the system is exactly the anchor at 3.

OneTrust

The GDPR pages describe a live record of processing assembled from assessments, system integrations and imports, automated DPIA and PIA workflows, and vendor files holding DPAs, transfer mechanisms and security obligations — a connected model corroborated by assessment launch, approval, archive and template APIs in the developer portal. The same developer documentation, though, describes the published GDPR Transfer Impact Assessment template as not directly addable, requiring a stop-gap import through an API. We found no public information on TOM management, legal bases driving DPIA triggers, or reusable group templates.

DataGuard

"Betroffenenanfragen" and "Sicherheitsvorfälle und Datenpannen" appear only as bullet names — no statutory clock, no 72-hour workflow, no intake portal, no identity check, and the word 'deletion' never occurs anywhere in the evidence. A request log and a breach list is precisely what the anchor at 3 describes.

OneTrust

Rights operations are convincingly evidenced: intake through a secure portal and a documented API, automated identity verification, data retrieval and deletion, legal hold checks and redaction, timestamped logging of every action, and the one-month response window with a two-month extension named. On the incident side the pages offer only "streamline incident management" and an incident management API family — we found no public information on a 72-hour clock, severity assessment, or authority notification output, nor on deletion execution tracked against the processing record.

DataGuard

The frameworks list is DSGVO plus four security regimes (ISO 27001, TISAX, NIS2) and an AI Act mention — exactly one actual privacy law, no BDSG, no Swiss nDSG, no UK GDPR, and no evidence a record maps across regimes. The TISAX badge comes with a disclaimer that DataGuard has no business relationship with ENX — the certification logo that links nowhere.

OneTrust

GDPR is worked deeply — readiness assessments against the seven principles, a published and versioned transfer impact assessment template, Europrivacy certification preparation — and CCPA appears by name in the DSR portal and global opt-out API, with an AI Governance module in the API catalog. Beyond those, we found no public information on Swiss or German national law, UK GDPR, ePrivacy or AI Act privacy duties being operationalized, and nothing showing one processing record mapping across regimes.

DataGuard

"Reporting & Visualisierungen" and templates with "Bestätigungen & Nachverfolgung" suggest report generators, but the entire audit story rests on unsubstantiated marketing numbers: 100% first-attempt success and "alle Kunden" passing ISO 27001 and TISAX audits first try. No revision-safe history, no evidence packs, no auditor access role anywhere in the evidence.

OneTrust

The developer portal carries the strongest proof: an endpoint exporting an audit log of deleted assessments, assessment exports including respondents, approvers and risks, and a bulk export recipe generating data subject, consent receipt and cookie receipt exports for regulatory reporting. The GDPR pages add timestamped request logging, per-individual consent history and auditable vendor outcomes. We found no public information on auditor access roles, audit-scoped evidence packs, or reports reconstructing the program state on a given date.

DataGuard

"Integrationen & APIs" and "KI-gestützte Automatisierung" are listed as plan inclusions, yet not a single named connector, documented API, webhook, SCIM or directory import appears anywhere — 'AI-powered automation' with nothing behind the label. SSO and granular roles are real but modest; a closed island with an API claim not worth the name sits at 3.

OneTrust

The best-evidenced strength of the set: documented REST APIs spanning every module, SCIM user provisioning, a bulk export script with full job lifecycle control, native Swift and Java SDKs, and DSAR connectors for MuleSoft, Apigee, Amazon API Gateway and Azure App Gateway behind a 500-plus pre-built plug-ins claim. Even here, the framework bridging documentation concedes some native methods go unexposed unless requested through a representative. We found no public information on webhooks or SSO, and the AI-Ready Governance Platform name carries no evidenced in-workflow AI assistance — the privacy notice describes AI use only for user experience and internal operations.

DataGuard

The imprint confirms a German GmbH (Munich, HRB 235942, Amtsgericht München) — and that is the entire sovereignty story: hosting location, subprocessor list and a DPA appear on none of the captured pages, with US/UK VC money in the background per the provenance note. For the system that would hold your RoPA, an entirely dark processing chain keeps this at the bottom of the scale, nudged off zero only by the confirmed EU entity.

OneTrust

A buyer's entire processing record would sit with OneTrust, LLC of Atlanta: US headquarters, a US entity on the copyright and Data Privacy Framework certification, explicit FTC enforcement jurisdiction, and a board including US investors — with SCCs, the UK addendum and a Schrems II white paper as the transfer armor. The trust page does publish a DPA, SCCs and a subprocessor list, which is more than the floor. We found no public information on EU hosting as a default, named data centers, or where the subprocessor chain sits jurisdictionally.

DataGuard

The pricing page names Base and Pro and what each contains but not one currency figure — the only price signal on the entire site is "bis zu 50 % günstiger als externe Berater", a slogan, not an invoice. Worse, Pro bundles experts, data migration and an external ISB: consulting sold as a software tier, so the real total is computable by nobody but sales.

OneTrust

We found no public pricing on any captured page — no figures, edition boundaries, user or entity counts, or billing periods on the homepage, product pages, developer portal or about page. A buyer cannot compute even a rough invoice from public information; every configuration appears to begin with a sales conversation.