# TrustWorks — Data Protection

TrustWorks by TrustWorks holds a panel rating of 2.5/5 from 6 AI judges (category median 2.5/5), as of 2026-10-21. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: TrustWorks (https://www.trustworks.io)
- Category: [Data Protection](https://whats-best.ai/software/data-protection.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/data-protection/trustworks
- Alternatives: https://whats-best.ai/software/data-protection/trustworks/alternatives ([markdown](https://whats-best.ai/software/data-protection/trustworks/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-21 · oldest source captured 2026-10-20

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: TrustWorks
- Headquarters: Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting: Default not stated; pages mention the EU [S1]
- Free plan: Not stated on the vendor’s pages as of 20 Oct 2026

## The panel's verdict

TrustWorks is a privacy management platform whose strongest showing is privacy management, clustering at 7 to 8: judges credit AI-assisted records of processing synced to a real-time data map, DPIA screening with reassessment triggers, and a recommendation engine suggesting lawful bases and retention schedules. Weakest is sovereignty at 1 to 2: the captured homepage states that personal data remains within the EEA and privacy experts are based in Europe, but the judges found no public information on the legal entity's jurisdiction, ownership, a published data processing agreement or subprocessors. The bench splits on framework coverage, spanning 5 to 7: higher scores credit California content current through 2026 obligations, 2027 automated-decision deadlines and phased 2028-2030 certification, while lower scores point to no public information on UK, Swiss or German variants behind a claim of more than 80 worldwide regulations. Rights and incident handling scores 5 to 6: requests are operational, erasure executes in Jira and LDAP, but the pages show no breach register, 72-hour clock or authority-notification output. Only a free start and a free OneTrust migration trial are published.

**Speaks for it:**
- Privacy management scores cluster at 7 to 8, on AI-assisted records of processing synced to a real-time data map with DPIA screening triggers and reusable templates
- Jira and LDAP connectors perform discovery, classification and actual erasure under GDPR and retention policies
- Data subject requests are consolidated across channels with identity verification, duplicate detection and a no-code workflow builder
- California content is current through the 2026 obligations, the 2027 automated-decision deadline and phased 2028-2030 certification
- Assessments preserve advice, decisions, versions and an audit-ready history with recurring reviews and assigned owners

**Held against it:**
- Sovereignty scores sit at 1 to 2, with no public information on legal entity jurisdiction, ownership, a published data processing agreement or subprocessors
- No public information on a breach register, the 72-hour clock or authority-notification output
- Integration evidence stops at two named connectors, with no public information on a documented API, webhooks or SSO and SCIM
- No public information on exportable evidence packs, auditor access roles or reconstructing a record's state at a past date
- No public information on UK, Swiss or German law variants, or on the list behind the more-than-80 regulations claim

**Best for:**
- You need a connected record of processing activities, with AI-assisted records, a real-time data map and DPIA screening with reassessment triggers
- Your team handles data subject requests from support tools, email and forms and already runs Jira or LDAP, where erasure executes under GDPR and retention policies
- You operate under CCPA/CPRA and need maintained California content alongside an AI Act governance module
- You are moving off a legacy privacy tool such as OneTrust and want to test the free migration trial first

**Avoid if:**
- Your procurement requires a documented chain — legal entity jurisdiction, a published data processing agreement, a subprocessor list — before a platform holds your entire register
- You need evidenced breach handling: a breach register, the 72-hour clock and authority-notification output
- Your audit defence depends on exportable evidence packs, auditor access roles or showing a record's state at a past date
- Your estate reaches beyond Jira and LDAP and needs a documented API, webhooks or SSO and SCIM

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v2). "n/r" = not rated: the vendor publishes no price.

| Criterion | The External DPO | The In-House Counsel | The Drafted Generalist | The Lead Auditor | The IT Integrator | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Records & DPIA depth | 3.5/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 | 3.5/5 |
| Data subject rights & incidents | 3/5 | 2.5/5 | 3/5 | 2.5/5 | 2.5/5 | 2.5/5 |
| Privacy regime coverage | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 2.5/5 | 2.5/5 |
| Audit readiness & evidence | 2.5/5 | 2.5/5 | 3/5 | 3/5 | 2/5 | 2.5/5 |
| Integrations & automation | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 | 2.5/5 |
| European sovereignty | 1/5 | 1/5 | 1/5 | 0.5/5 | 1/5 | 1/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **2.5/5** | **2.5/5** |

### The judges

- **The External DPO** (v2.0): Carries thirty client mandates and bills by the hour they save. Optimizes for multi-client capability, reusable templates, a RoPA that drives the rest, and client-ready reports. Rejects single-tenant tools that treat the consultancy as thirty separate customers.
- **The In-House Counsel** (v2.0): Answers personally when the authority writes. Optimizes for defensibility: request clocks that never slip, a breach workflow that produces the Art. 33 notification, regime coverage that matches where the company actually operates. Rejects tools whose legal content nobody maintains.
- **The Drafted Generalist** (v2.1): Office manager at an 80-employee firm who got compliance added to her job title, not her calendar. Optimizes for guided workflows in plain language and software that knows the law so she does not have to. Rejects consultant-shaped platforms that assume a compliance department.
- **The Lead Auditor** (v2.0): Audits management systems for a living and has seen every folder of screenshots. Optimizes for revision-safe history, evidence packs on demand, and a defensible answer to "show me the state on date X". Rejects systems where the audit trail is assembled the week before the audit.
- **The IT Integrator** (v2.0): Has to feed the compliance platform from the estate that already exists: Entra ID, Jira, the CMDB. Optimizes for directory import, a real API, webhooks and SSO — compliance data that stays current because it syncs, not because someone retypes it. Rejects data islands with a CSV drawbridge.
- **The Skeptic** (v2.1): Hunts certification logos that link nowhere, "AI-powered" features with no substance behind them, consulting bundled as software, legal-update promises with no named lawyer, and customer counts that disagree between pages. Exists to keep the rest of the bench honest.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Optout preference signals: Global Privacy Control [S7]
- Regulation coverage: 80 [S1]

**Hosting**
- Data residency: EEA [S1]

**Integrations**
- Discovery classification connectors: pre-built connectors · yes [S8]
- Ldap discovery classification: Pre-built connectors to discover and classify personal information in LDAP [S9]
- Modules listed: Data Map · Record of Processing Activities · TrustWorks Engage · AI Governance · Data Subject Requests · Privacy Assessments · Risk Management · Consent Management [S1]

**Legal**
- Administrative fines: usd · 2663 · 7988 [S7]
- Admt deadline: 2027 [S7]
- CCPA data threshold: 100000 · 50 [S7]
- CCPA definition: CCPA · CPRA [S7]
- CCPA revenue threshold 2025: usd · 2025-01-01 · 26.625 [S7]
- Cybersecurity audit certification: annual · 2028-2030 [S7]
- Enforcement agencies: California Privacy Protection Agency · California Attorney General [S7]
- Nonprofits excluded: no [S7]
- Optout deadline: 15 [S7]
- Privacy notice link: yes [S4]
- Private right of action: yes [S7]
- Request deadlines: 45 · 45 · 10 [S7]
- Requirements 2026: 2026-01-01 · risk assessments · annual cybersecurity audits · automated decision-making technology (ADMT) [S7]
- Statutory damages: usd · 799 · 107 [S7]

**Pricing**
- Free start: yes [S2]

**Product**
- AI assistant: AI Assistant offering guidance on lawful basis, retention schedules and RoPA completeness [S1]
- AI assisted ropa: AI-assisted RoPA synced with data map [S1]
- AI governance: AI governance module supporting AI Act compliance [S1]
- All solutions: Data Map · Record of Processing Activities · TrustWorks Engage · AI Governance · Data Subject Requests · Privacy Assessments · Risk Management · Consent Management [S5]
- Assessments: DPIA · TIA · LIA [S1]
- Audit readiness: yes · Audit readiness module [S7]
- Award: Winner of Most Impactful Data Privacy Product at PICCASO Awards [S1]
- Award: Most Impactful Data Privacy Product at the PICCASO Awards [S3]
- Award: Winner of Most Impactful Data Privacy Product at the PICCASO Awards [S5]
- Award: Most Impactful Data Privacy Product at the PICCASO Awards [S8]
- Award: Winner of the Most Impactful Data Privacy Product at the PICCASO Awards [S7]
- Award piccaso: Most Impactful Data Privacy Product at the PICCASO Awards [S4]
- CCPA data mapping: yes · Data mapping for CCPA [S7]
- Clients named: Glovo · Wildlife Studios · VTEX [S7]
- Competitor positioning: OneTrust Alternative [S4]
- Competitor positioning: Positioned as a OneTrust alternative [S5]
- Connected assessments: DPIA · PIA · TIA · AI impact assessments [S3]
- Consent management: yes [S1]
- Consumer requests: yes · Consumer requests module [S7]
- Core capabilities: Consumer data mapping · Request and identity workflows · Notice and purpose records · Opt-out and consent orchestration · Risk assessments and audit evidence · Vendor and contract oversight [S7]
- Customer glovo: Glovo · Wildlife Studios · VTEX [S8]
- Data discovery: Discovery and classification of data assets storing personal data with auto-generated risk insights [S5]
- Data discovery classification: yes · yes [S2]
- Data map: Real-time data map with integrations and vendor insights [S1]
- Data subject rights: DSR module with no-code workflow builder and automations [S1]
- Data taxonomy: processing activities · assessments · surveys · yes · yes [S2]
- Dpia audit trail: audit trail and recurring reviews [S3]
- Dpia collaboration: stakeholder collaboration and approvals [S3]
- Dpia continuous review: yes [S3]
- Dpia evidence approvals: yes [S3]
- Dpia processing context: data-flow and processing context linked to assessments [S3]
- Dpia risk scoring: risk scoring and mitigation plans [S3]
- Dpia screening: DPIA screening and triggers with reusable templates and questionnaires [S3]
- Dsr automation: Automated DSR fulfilment with pre-built connectors to third-party tools and custom components for in-house tools [S5]
- Dsr centralised management: Centralised DSR management consolidating all request channels in one repository with status tracking [S5]
- Dsr form fields: Category of Individuals · DSR Type · Email · Reason / Comment [S4]
- Dsr rights form: yes [S4]
- Dsr types selectable: yes [S4]
- Engage module: TrustWorks Engage: AI-powered screening discovers and classifies activities across the organisation [S1]
- EU based: Privacy experts based in Europe [S1]
- Free onetrust migration trial: yes [S1]
- Free tier start: Free start offered [S9]
- Free trial: Start free option available [S5]
- Free trial: Start free now [S8]
- GDPR AI governance solution: Privacy Management & AI Governance solution; PICCASO award winner [S9]
- Identity verification: Identity verification, pre-execution checks and automatic duplicate request detection [S5]
- Jira erase personal data: yes · yes [S8]
- Jira privacy automation: automates privacy requests in Jira and other SaaS vendors [S8]
- Ldap access erasure: TrustWorks accesses and erases personal information from LDAP per GDPR and retention policies [S9]
- Ldap privacy requests: TrustWorks automates privacy requests in LDAP and other SaaS vendors [S9]
- Multi channel intake: customer support tool · e-mail · other [S5]
- Named clients: Glovo · Wildlife Studios · VTEX [S4]
- Named clients: Glovo · Wildlife Studios · VTEX [S5]
- Onetrust alternative positioning: yes [S3]
- Onetrust migration trial: free OneTrust migration trial · yes [S3]
- Onetrust migration trial: Free OneTrust migration trial · yes [S7]
- Other use cases: Data Mapping · Privacy Assessments · Data Subject Requests · Code Scanner [S2]
- Preference governance: yes · Preference governance module [S7]
- Privacy centre: Privacy centre giving customers a user-friendly experience to access their data [S5]
- Rating: 4.7 [S1]
- Recommendation engine: yes · yes · yes [S2]
- Recommendations based on tools: yes [S2]
- Related modules: Data Mapping · Processing Activities · Privacy Assessments · Code Scanner [S5]
- Risk assessments: yes · Risk assessments module [S7]
- Risk management: yes [S1]
- Ropa automation: days, not months · automated RoPA building and maintenance [S2]
- Ropa healthcheck: yes · yes [S2]
- Ropa import: yes · yes [S2]
- Single platform claim: CCPA workflows combined in one collaborative privacy platform [S7]
- Solution modules: Data Map · Record of Processing Activities · TrustWorks Engage · AI Governance · Data Subject Requests · Privacy Assessments · Risk Management · Consent Management [S3]
- Solution modules: Data Map · Record of Processing Activities · TrustWorks Engage · AI Governance · Data Subject Requests · Privacy Assessments · Risk Management · Consent Management [S4]
- Solution modules: Data Map · Record of Processing Activities · TrustWorks Engage · AI Governance · Data Subject Requests · Privacy Assessments · Risk Management · Consent Management [S8]
- Solution modules: Data Map · Record of Processing Activities · TrustWorks Engage · AI Governance · Data Subject Requests · Privacy Assessments · Risk Management · Consent Management [S9]
- Solution modules: Data Map · Record of Processing Activities · TrustWorks Engage · AI Governance · Data Subject Requests · Privacy Assessments · Risk Management · Consent Management [S7]
- Solutions list: Data Map · Record of Processing Activities · TrustWorks Engage · AI Governance · Data Subject Requests · Privacy Assessments · Risk Management · Consent Management [S2]
- Template reuse: yes · yes · yes [S3]
- Trial booking: yes [S2]
- Vendor management: yes [S1]
- Vendor oversight: yes · Vendor oversight module [S7]

## Questions

### Is TrustWorks European?

Not determined: the vendor’s pages as captured do not say where TrustWorks is based.

### Where does TrustWorks store data?

The default storage location for customer data is not stated on the vendor’s pages as of 20 Oct 2026. The vendor’s pages mention the EU as hosting location, per [the vendor’s page captured 20 Oct 2026](https://whats-best.ai/evidence/9299).

### Does TrustWorks have a free plan?

Not stated on the vendor’s pages as of 20 Oct 2026.

### What are the best alternatives to TrustWorks?

As of 21 Oct 2026, the panel rates [preeco | datenschutz (4/5)](https://whats-best.ai/software/data-protection/preeco), [Dastra (3/5)](https://whats-best.ai/software/data-protection/dastra) and [caralegal (3/5)](https://whats-best.ai/software/data-protection/caralegal) highest among the other 41 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | datenschutz](https://whats-best.ai/software/data-protection/preeco) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [TrustWorks alternatives](https://whats-best.ai/software/data-protection/trustworks/alternatives).

## What this page leaves out

- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.

## Sources

- [S1] Vendor page: https://www.trustworks.io (checked 2026-10-20)
- [S2] Records & DPIA depth — found from sitemap: https://www.trustworks.io/solutions/processing-activities (checked 2026-10-20)
- [S3] Records & DPIA depth — found from sitemap: https://www.trustworks.io/regulation/dpia (checked 2026-10-20)
- [S4] Data subject rights & incidents — found from sitemap: https://www.trustworks.io/data-subject-rights (checked 2026-10-20)
- [S5] Data subject rights & incidents — found from sitemap: https://www.trustworks.io/solutions/data-subject-requests (checked 2026-10-20)
- [S6] Privacy regime coverage — found from sitemap: https://www.trustworks.io/regulation/gdpr (checked 2026-10-20)
- [S7] Privacy regime coverage — found from sitemap: https://www.trustworks.io/regulation/ccpa (checked 2026-10-20)
- [S8] Integrations & automation — found from sitemap: https://www.trustworks.io/integrations/privacy-in-jira (checked 2026-10-20)
- [S9] Integrations & automation — found from sitemap: https://www.trustworks.io/integrations/privacy-in-ldap (checked 2026-10-20)

---

Cite as: whats-best.ai, "TrustWorks — Data Protection", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/data-protection/trustworks

Corrections: https://whats-best.ai/correct/884?target=page