Data Protection
Sirdata CMP
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by SIRDATA SAS · sirdata.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Sirdata CMP at a glance
- Vendor
- SIRDATA SAS
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Panel verdict
- The AI panel rates Sirdata CMP 0.5/5, the mean of 6 judges. Sirdata CMP (vendor SIRDATA SAS) was judged from a single captured vendor page that markets consent and advertising tooling — audience insights, contextual targeting, cookieless predictive audiences and server-side Google Tag Manager deployment — and the scores follow that positioning. how scores are made
- As of
- Vendor pages captured 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Sirdata CMP (vendor SIRDATA SAS) was judged from a single captured vendor page that markets consent and advertising tooling — audience insights, contextual targeting, cookieless predictive audiences and server-side Google Tag Manager deployment — and the scores follow that positioning. Its strength is connectivity: integrations and automation scores cluster at 3-4, resting on three named APIs (Sirdata, Semantic, ABconsent), a GitHub presence and the tag-manager deployment path. The compliance core sits at the floor: privacy management, rights and incident handling, and audit readiness each show a maximum score of 0, and framework coverage spans 0-2 because the captured page names no privacy regime. The genuine split is sovereignty: four of six judges scored 4 on the vendor's stated EU server location and French entity form; the lead auditor scored 3 and the skeptic 1, because the captured sentence — "100% of our servers in" — truncates before naming any location, and no DPA, subprocessor list or data center is documented. No public pricing was found.
Speaks for it
- Named APIs — Sirdata, Semantic and ABconsent — plus a GitHub presence go beyond file import, with integration scores at 3-4
- Server-side Google Tag Manager deployment is confirmed on the captured page
- Consent and audience capabilities are confirmed, including cookieless predictive audiences and contextual targeting
- Four of six judges scored sovereignty 4, citing the vendor's stated EU server location and its French entity form
Held against it
- Privacy management, rights and incident handling, and audit readiness each show a maximum score of 0
- No records of processing, DPIA workflows, processor and DPA management or TOMs found on the captured page
- Nothing found on data subject requests, statutory deadlines, breach registers or authority notification output
- Framework coverage spans 0-2; the captured page names no privacy regime it operationalizes
- No published DPA, subprocessor list or named data centers found; no sovereignty attributes are on record and the captured servers sentence truncates before a location
Best for
- You run a server-side Google Tag Manager stack and want a consent platform wired in via named APIs — the 3-4 integration scores rest on exactly those interfaces
- You are buying a consent and audience platform for cookieless advertising, with confirmed contextual targeting and predictive audiences
- An EU hosting claim matters to your shortlist — four of six judges scored that 4 — provided you verify the processor chain with the vendor
Avoid if
- You need a records-of-processing register, DPIA workflows or TOM management — the captured page instead markets audience and contextual targeting, and privacy management tops out at 0
- You must run data subject requests and breach notification on statutory clocks — the captured material speaks to marketing consent signals instead, and rights and incident handling also tops out at 0
- You operate under several privacy regimes — the page names none, and framework coverage spans 0-2
- You need a documented processor chain before signing — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Records & DPIA depth | 0 of 5 |
| Data subject rights & incidents | 0 of 5 |
| Privacy regime coverage | 0.5 of 5 |
| Audit readiness & evidence | 0 of 5 |
| Integrations & automation | 2 of 5 |
| European sovereignty | 2 of 5 |
Records & DPIA depth
Show reasoningHide reasoning
How this is scored
The DSMS core: records of processing (RoPA/VVT), data protection impact assessments, processor/DPA management and TOMs — how deeply the legal artifacts are modeled and connected.
0 — Document templates in a folder tree; the "register" is a Word file with version numbers in the filename.
3 — A structured RoPA with basic fields and a DPIA questionnaire, but processors, TOMs and legal bases live outside the system.
5 — RoPA and DPIA as linked modules with templates; processor management and TOM assignment exist but are shallow, and group reuse is copy-paste.
8 — A connected data model — processing activities linked to systems, processors, TOMs and legal bases — with DPIA triggers derived from the record, reusable group templates, and outputs a supervisory authority accepts.
10 — Privacy records as a system of record: the RoPA drives DPIAs, processor management and TOM coverage from one data model, multi-client/mandate capability included, and the documentation is audit-ready without manual assembly.
The External DPO
The captured page positions this as a consent and audience-targeting platform — cookieless predictive audiences, contextual targeting, server-side tag management — and we found no public information on records of processing, DPIA workflows, processor management or TOMs. Nothing in evidence runs a mandate's legal artifacts, let alone thirty of them on one data model. 1
The In-House Counsel
The captured pages describe audience insights, contextual targeting and cookieless predictive audiences, and I found no public information on records of processing, DPIAs, processor management or technical and organisational measures. For the artifacts an authority asks to see first, there is nothing here I could put in front of an auditor. 1
The Drafted Generalist
The captured page describes audience and contextual targeting, cookieless predictive audiences, and tag-manager deployment — advertising tools, not a records register. We found no public information on records of processing, DPIAs, processor and DPA management, or TOMs, which for records and impact-assessment depth is the bottom of the scale. 1
The Lead Auditor
The captured page sells audience targeting, contextual targeting and cookieless predictive audiences; I found no public information on records of processing, DPIA questionnaires, processor management or TOM assignment. Nothing here models the legal artifacts an auditor would ask to see, so this sits at the floor of the scale. 1
The IT Integrator
The captured pages present consent APIs, contextual and cookieless predictive audiences and a Google Tag Manager server-side offer; I found no public information on records of processing, DPIAs, or processor, DPA and TOM management. As far as this evidence goes, there is no DSMS data model to assess. 1
The Skeptic
Every confirmed capability on the captured page is adtech: audiences, contextual and cookieless targeting, and tag-manager deployment. We found no public information on records of processing, DPIA, processor and DPA management, or TOMs — the legal artifacts this criterion is about appear publicly as nothing at all. 1
Data subject rights & incidents
Show reasoningHide reasoning
How this is scored
The operational half of the DSMS: data subject request handling with statutory clocks, breach register and authority notification, deletion concepts that actually delete.
0 — Requests arrive by email and live there; breaches are a phone call and a memo.
3 — A request log and a breach list exist, but deadlines are manual, intake is unstructured, and deletion rules are documentation rather than workflow.
5 — DSR workflows with the Art. 12 clock tracked, structured breach register with the 72-hour clock, deletion concepts assignable to records; automation is reminders.
8 — Intake channels for requests (portal/form), identity-check support, deadline automation with escalation, breach severity assessment and authority-report output, deletion rules tied to the RoPA with execution tracking.
10 — Rights and incidents as operations: end-to-end request handling an authority audit walks through, breach workflows that produce the Art. 33 notification, and deletion automation with evidence that the deletion happened.
The External DPO
We found no public information on data subject request intake, statutory clocks, breach registers, authority notification output or deletion execution. The material in evidence is oriented to marketing consent signals rather than rights and incident operations. 1
The In-House Counsel
I found no public information on data subject request workflows, statutory deadline tracking, identity checks, a breach register or authority notification output. Without an evidenced 72-hour clock and a workflow that produces the Art. 33 notification, the incident half of compliance stays a phone call and a memo. 1
The Drafted Generalist
We found no public information on data subject request workflows, statutory clocks, breach registers, authority notifications, or deletion execution. Nothing in the capture speaks to rights and incident handling at all, so I cannot evidence this capability even at a request-log level. 1
The Lead Auditor
I found no public information on data subject request intake, statutory deadline tracking, a breach register or deletion execution with evidence of completion. The operational half of a data protection program is simply not on the captured page. 1
The IT Integrator
I found no public information on data subject request handling, a breach register, authority notification or deletion workflows. The operational half of privacy management simply is not evidenced on the captured page. 1
The Skeptic
We found no public information on data subject request handling, statutory deadlines, breach registers, authority notification output, or deletion workflows. The capture is silent on the entire operational half of a compliance program. 1
Privacy regime coverage
Show reasoningHide reasoning
How this is scored
Which privacy regimes the product actually operationalizes — GDPR, BDSG, Swiss nDSG, UK GDPR, ePrivacy, EU AI Act privacy duties — and whether one record maps across them or each regime is a fresh island.
0 — One regime, hard-coded; anything else is "on the roadmap".
3 — GDPR plus one national law as separate checklists; the same processing activity is documented once per regime.
5 — The major regimes for its market with partial cross-mapping; newer duties (AI Act, ePrivacy changes) present as content packs of varying depth.
8 — Broad current coverage with one-record-many-regimes mapping and visible maintenance as regimes evolve.
10 — Regime coverage as a living product: multiple privacy regimes on one data basis, per-country variants, and documented update cadence when the law moves.
The External DPO
Consent tooling and EU-only hosting gesture at European rules, but we found no public information on which privacy regimes the product operationalizes, per-country variants, or any one-record-many-regimes mapping. At best a sliver of one regime's duties is in view. 1
The In-House Counsel
The captured pages make no statement about which privacy regimes the product operationalizes — no GDPR, BDSG, Swiss nDSG or UK GDPR content, and no cross-regime mapping of one record. I found no public information at all here, so I cannot confirm coverage matches where a company actually operates. 1
The Drafted Generalist
We found no public information on which privacy regimes the product operationalizes — no GDPR, BDSG, Swiss nDSG, or AI Act duties appear anywhere in what was captured. The page markets targeting capabilities instead of regime documentation. 1
The Lead Auditor
The only regime-adjacent signal is a consent API and privacy-respectful targeting copy implying EU consent-law operation; the captured page names no specific privacy regimes. I found no public information on cross-regime mapping, national variants or update cadence as the law moves. 1
The IT Integrator
The consent and cookieless-targeting features sit in GDPR and ePrivacy territory by their nature, but no regime is named as operationalized and I found no public information on cross-regime mapping or update cadence. A single implied regime with no documented model earns almost nothing on this bench. 1
The Skeptic
The captured page names no privacy regime — not GDPR, not ePrivacy, not any national variant — and shows no cross-mapping or update cadence. We found no public information on which regimes the product operationalizes, so I can only score what the marketing page asserts, which is none. 1
Audit readiness & evidence
Show reasoningHide reasoning
How this is scored
Whether the system produces defensible proof: revision-safe history, evidence collection, reports for auditors, authorities and management.
0 — Exports are screenshots; history is overwritten in place.
3 — PDF reports exist but evidence is attached ad hoc and changes leave no reliable trail.
5 — Versioned records, standard report generators for the core registers, evidence attachments per activity; assembling a full audit file still takes days.
8 — Revision-safe change history, audit-scoped evidence packs on demand, management and authority reports current at a click, auditor access roles.
10 — Audit readiness as a standing state: continuous documentation status per regime and scope, exportable proof packs an auditor accepts as-is, and a defensible answer to "show me the state on date X".
The External DPO
We found no public information on revision-safe change history, evidence collection, auditor access roles, or management- and authority-facing reporting. There is nothing here from which a defensible audit file could be assembled. 1
The In-House Counsel
I found no public information on revision-safe change history, evidence collection, auditor access roles or authority and management reports. A demand to show the state of the documentation on a given date would have no documented answer in these pages. 1
The Drafted Generalist
We found no public information on revision-safe history, evidence collection, auditor or authority reports, or access roles for auditors. I have nothing captured that would let me defend our documentation state to a supervisor. 1
The Lead Auditor
I found no public information on revision-safe change history, evidence packs, auditor access roles or management and authority reports. For a system that would hold a compliance record, nothing shown here supports a defensible answer to the state on a given date. 1
The IT Integrator
I found no public information on revision-safe history, evidence collection, auditor or authority reports. There is nothing here an auditor could be handed. 1
The Skeptic
We found no public information on revision-safe change history, evidence collection, auditor access, or report generation. A single product page with audience-targeting copy is the whole record here, and it contains no audit-facing capability. 1
Integrations & automation
Show reasoningHide reasoning
How this is scored
Whether the platform feeds from the real IT estate — directory import, ticketing, API — and automates the recurring privacy work instead of re-typing it.
0 — A closed island: manual entry in, PDF out, no API.
3 — CSV/Excel import and export; no live connections, no API worth the name.
5 — Directory import (AD/Entra), a documented REST API for core objects, a handful of native connectors (ticketing or SSO); automation is reminders and recurrence.
8 — Real connector set (ticketing, HR or asset sources), webhooks, SSO/SCIM, workflow automation with delegation and escalation, useful AI assistance with human review.
10 — The platform behaves like infrastructure: API parity for the data model, event streams, bidirectional sync with the estate, and automation that measurably removes the recurring toil (reviews, attestations, evidence pulls) rather than renaming it.
The External DPO
Three named APIs, a GitHub presence and server-side Google Tag Manager deployment show live connectivity beyond file import and export. We found no public information on directory import, SSO or SCIM, ticketing connectors, or workflow automation with delegation and escalation. 1
The In-House Counsel
Named interfaces — the Sirdata API, a Semantic API, the ABconsent API, a GitHub presence and server-side Google Tag Manager deployment — show this is not a fully closed island, but I found no public information on API documentation depth, directory import, ticketing or SSO. These hooks serve advertising deployment, not automation of recurring privacy work such as reviews and attestations. 1
The Drafted Generalist
The page names a Sirdata API, an ABconsent API, a Semantic API, a GitHub presence, and server-side Google Tag Manager deployment — real named interfaces rather than file import alone, which sits above the import/export level. But we found no public information on directory import, SSO, ticketing connectors, or automation of recurring compliance work, so this lands below the directory-plus-API level. 1
The Lead Auditor
Named APIs for consent, semantic/audience data and the platform itself, plus server-side Google Tag Manager deployment and a GitHub presence, give real programmatic access to core objects. I found no public information on directory import, SSO or SCIM, ticketing connectors or webhooks, so this lands between basic import/export and a true connector set. 1
The IT Integrator
Named APIs (Sirdata, Semantic, ABconsent) and a server-side tag-manager deployment path are live connections rather than a CSV drawbridge, which is above the import-export floor. But the API scope and documentation are not shown, and I found no public information on directory import, webhooks, SSO or ticketing and HR connectors — from my seat, the estate-sync half is unevidenced. 1
The Skeptic
The page names a Sirdata API, an ABconsent API, a Semantic API, and Google Tag Manager server-side deployment — names on a homepage, not documentation. We found no public information on directory import, ticketing or HR connectors, SSO, webhooks, or workflow automation, so the integration story stays at the assertion level. 1
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Where the compliance record of the whole company actually lives and under whose law — entity, hosting, subprocessors, DPA. A platform that maps your processing is itself your most concentrated processing.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for the system holding your RoPA.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The External DPO
The vendor states all servers sit in the EU, which is the right default; we found no public information on a published DPA, a subprocessor list, or named data centres. For a system that would map a client's processing, the public chain behind that claim is thin. 1
The In-House Counsel
The vendor states that 100 percent of its servers are in the EU, and the name SIRDATA SAS indicates a French entity form, which anchors the hosting and entity questions. I found no public information on a published DPA, a subprocessor list, named data centers or TOMs — for the platform that would hold my most concentrated compliance data, the documented chain ends at hosting. 1
The Drafted Generalist
The vendor is a French company and states that 100% of its servers are in the EU, which is better than an on-request EU region. We found no public information on the DPA, the subprocessor list, or named data centers, so only half the chain is documented. 1
The Lead Auditor
The vendor states 100% of its servers are in the EU, which is a usable hosting claim; however, the sovereignty attributes on record are empty and I found no public information on a published DPA, a subprocessor list or named data centers. An EU server footprint without a documented processor chain is not a defensible position for a system holding sensitive records. 1
The IT Integrator
The captured page claims one hundred percent of servers in the EU and the vendor is a French SAS, which is genuine hosting evidence for a consent platform. No data centers are named, and I found no public information on a DPA or a subprocessor list, so the chain above the servers is undocumented. 1
The Skeptic
The sole sovereignty-relevant claim is a sentence that truncates mid-phrase — "100% of our servers in" — before naming any location, and the record carries no sovereignty attributes. We found no public information on a DPA, a subprocessor list, data center locations, or the vendor's jurisdiction, which is precisely what a buyer needs for a system that maps processing. 1
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per module, per entity, per year, with consulting unbundled — from public pages alone. Unpublished pricing is the B2B norm in this market, so this criterion describes rather than condemns; the benches weight it accordingly.
0 — No public prices at all; every configuration is a sales conversation.
3 — An entry price exists, but module add-ons, entity counts or bundled consulting make the real total incomputable.
5 — Most editions carry real numbers with billing period stated and software separated from services; at least one commonly needed module or scale step is unpriced.
8 — Every edition and module priced publicly with entity/user boundaries and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: modules, scale steps, service packages and renewal rules public, so the invoice for a 100-employee company and a 10-client consultancy is a two-minute exercise.
The External DPO
We found no public pricing information on the captured page — no edition figures, module prices, billing periods or entity boundaries — so the real invoice is not computable from public pages alone. Unpublished pricing is common in this market; here it is simply the observed state. 1
The In-House Counsel
I found no public information on pricing — no edition figures, module prices, billing periods or consulting rates. From public pages alone no part of the real invoice is computable; the market norm of sales-led B2B pricing describes this but does not move it. 1
The Drafted Generalist
We found no public pricing information at all — no editions, no numbers, no billing periods, nothing to compute an invoice from. Every configuration would be a sales conversation, which is the floor for pricing transparency. 1
The Lead Auditor
I found no public prices anywhere on the captured page; no edition figures, billing periods or setup fees are stated. Every configuration would have to come from a sales conversation. 1
The IT Integrator
No price, edition, billing period or services split appears in the captured material; I found no public pricing information at all. Every configuration is a sales conversation. 1
The Skeptic
We found no public pricing: no editions, no modules, no billing periods, no separation of software from services on the captured page. Unpublished prices are the norm in this market, so I record it plainly — from these pages a buyer cannot compute any part of the invoice. 1
Questions about Sirdata CMP
Is Sirdata CMP European?
Not determined: the vendor’s pages as captured do not say where Sirdata CMP is based.
Where does Sirdata CMP store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Sirdata CMP have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to Sirdata CMP?
As of 21 Oct 2026, the panel rates preeco | datenschutz (4/5), Dastra (3/5) and caralegal (3/5) highest among the other 41 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | datenschutz (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Sirdata CMP alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 13 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (sirdata.com). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (1)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page sirdata.com Checked 13 Oct 2026 Details →