DataGuard, another provider, OTRIS and CIVAC in comparison: Compliance platforms 2026

The market for compliance software in Germany has become significantly more compact since the NIS2UmsuCG came into force on October 17, 2024 and the transition period to ISO/IEC 27001:2022 on October 31, 2026. Medium-sized companies with 50 to 5,000 employees are regularly faced with the same question: Is data protection software like DataGuard enough, or do they need a broader platform like other providers, a document-centric system like OTRIS, or a combination of workspace and external ordering like CIVAC. The supervisory authorities of the federal states, the Federal Office for Information Security and the Federal Commissioner for Data Protection have been checking much more closely since 2024, and the organisational responsibility according to Section 130 OWiG exacerbates the consequences of an inaccurate choice of provider in the fine procedure.

This article does not provide an advertising comparison table, but rather a sober analysis from practical audits from the last three years. It ranks four providers according to 14 criteria that are actually checked in an audit by the responsible supervisory authority: appointment certificate, reporting line, directory according to Art. 30 GDPR, order processing according to Art. 28, NIS-2 24/72 reporting path according to Section 32 BSI Act, ISMS connection according to ISO/IEC 27001:2022, EU data residency and seven others. At the end there is an assessment of which constellation which provider works and where CIVAC as a compliance platform and officer-as-a-service closes a gap that purely technical tools or pure personnel service providers systematically leave open.

DataGuard, based in Munich, has been positioning itself as Privacy-as-a-Service since 2017 and primarily provides external data protection officers plus an associated software interface. The strength lies in data protection in accordance with Art. 37 GDPR and Section 38 BDSG, the number of clients is stated to be over 3,000, the tariff starts in the low four-digit range per year and scales with the number of employees and module selection. ESG and information security modules have been added, but do not fully cover the 25 German officer roles. Data storage takes place in the EU, the appointment certificate for the external DPO is issued in a standardised manner, and the onboarding process typically lasts four to eight weeks.

another provider, founded in Munich in 2021, is an automation platform for data protection workflows with a focus on directories in accordance with Art. 30 GDPR, data subject inquiries and processor management. The approach is API-centric and is aimed at growing tech companies with a high cloud tool density. The external DSB order is not part of the core offer, but is implemented via partners or as an optional add-on. NIS 2 and ISMS functions are under construction, a consistent reporting line to management with a time-stamped audit trail is not the product focus.

OTRIS, founded in Dortmund in 1991, is classic enterprise content management with data protection and contract modules. The platform is widespread in the DAX environment and is strong in contract management, investment management and directory management. The approach is document-centric: files, workflows, file plans. However, the role appointment with a § 38 BDSG-compliant document, the NIS 2 reporting chain and an integrated officer-as-a-service are not the core business. For additional context on the CIVAC role, see the CIVAC role overview with all 25 representative profiles.

All three providers are authorised in their respective strengths segment. The question is not whether DataGuard, another provider or OTRIS are good products, but rather whether their respective range of functions completely covers the chain of obligations of a medium-sized or corporate German company. The answer depends on the risk profile and the number of agent mandates running in parallel. Anyone who operates several roles in parallel will reach the limit with a purely data protection-centric or purely document-centric solution and will inevitably consolidate responsibility at the management level.

A supervisory authority does not check the provider logo during an on-site appointment or in a written request for information, but rather the evidence. The following 14 points have been documented in audits by the state data protection authorities of Bavaria, Baden-Württemberg, Berlin and North Rhine-Westphalia since 2022: Firstly, the officer's appointment document with date, signature and responsibility, secondly, the documented reporting line to the top management level in accordance with Article 38 (3) GDPR, thirdly, the complete list in accordance with Article 30, fourthly, the order processing contracts in accordance with Article. 28, fifth, the documented technical and organisational measures in accordance with Art. 32.

Next: Sixth, the data breach register with deadline counter in accordance with Art. 33, seventh, the NIS-2 reporting chain 24/72 hours in accordance with Section 32 of the BSI Act, eighth, the ISMS status in accordance with ISO/IEC 27001:2022 including the 93 controls, ninth Proof of training per employee group with date and learning objective, tenth, the data residence and the subcontractor list with third country evaluation, eleventh, the audit trail with versioning and time stamp, twelfth, the replacement regulation in the event of illness or absence, thirteenth, the interface matrix for ISB, money laundering officer, whistleblower protection reporting centre and works council, fourteenth, the quarterly control documentation with decision log.

These 14 points are not exhaustive, but they are the minimum line. Any provider who leaves gaps here shifts the burden onto the company and thus onto the management in accordance with Section 130 OWiG. Audit-proof, documented, § 38-proof only applies if all 14 points can be verified in a system. A supplementary overview of the CIVAC answer to each individual point can be found in the CIVAC FAQ with specific template references for each criterion. In the following sections, each provider is checked against exactly these criteria, without marketing foil, with reference to the position in the respective chain of obligations.

DataGuard fully complies with points 1 to 5 in the data protection scope: The appointment certificate is issued, the reporting line is documented in the standard mandate, the list according to Art. 30 and the order processing contracts are maintained in the software, technical and organisational measures are stored as templates and can be supplemented with your own measures. Point 6, the data breach register, is integrated with a deadline notification for Art. 33 GDPR and reports the status to the responsible supervisory authority. Point 9, proof of training, is covered by the DataGuard Academy and provides a certificate with a date for each employee.

The picture becomes weaker with point 7, the NIS 2 reporting chain with 24-hour early warning and 72-hour follow-up report in accordance with Section 32 of the BSI Act. This is not part of the product core in 2026 and is offered separately via the information security services, without an integrated deadline counter in the same tenant. Point 8, the ISMS status according to ISO/IEC 27001:2022 with the 93 controls, is available as a consulting service, not as an integrated audit trail in the same tenant as data protection. Point 13, the interface matrix to other officers such as the money laundering officer, the whistleblower protection reporting office or the AGG complaint office, is not shown in the system.

DataGuard is functionally strong for pure data protection mandates of medium complexity. As soon as NIS 2 concerns, ISO/IEC 27001 certification and parallel representative roles come into play, tool breaks arise. The consequence: documents are located in several systems, the supervisory authority is presented with a composite evidence, and this is exactly where the gaps arise, which are later viewed as an organisational deficit and are incorporated into the fine assessment procedure in accordance with Article 83 (2) GDPR. For companies with multiple locations or a group structure, DataGuard requires a separate mandate for each subsidiary; a consolidated view at group level with a common reporting line is not the standard scope of delivery.

another provider scores on points 3 and 4: The Article 30 directory and processor management are automated via API integrations with Slack, AWS, Google Workspace, Microsoft 365 and comparable sources. Data flows are scanned, processing activities are suggested, subcontractor lists are imported, updates run continuously instead of quarterly. This is an operational advantage for fast-growing tech companies with a high tool density. Point 6, the data breach register, is available as a workflow and assigns each report to the responsible supervisory authority.

The picture becomes weaker at point 1, the commissioner's appointment certificate. another provider is primarily software, the external DPO is provided via partners, the order is not made in one piece, but in two contracts with a separate liability structure. Point 2, the reporting line to the top management level, is not documented as standard but must be set up by the company itself. Point 7, the NIS-2 path with 24/72 hour deadlines, is missing from the product core; Point 8, ISO/IEC 27001:2022 ISMS with 93 controls, is not the product goal. The platform is very strong in the data protection automation layer, but it does not replace the remaining 24 German representative roles.

For medium-sized tech companies with a US cloud stack and a pure data protection focus, another provider delivers speed. Anyone who needs a complete representative organisation with a data protection officer, information security officer, money laundering officer, reporting office and hygiene officer must also operate other systems. The result is classic tool fragmentation: three logins, three audit trails, three invoices, one risk. Others run compliance like a filing cabinet. We run it like software. In addition, although the API integrations recognise processing activities, the legal assessment in accordance with Art. 6 GDPR and the threshold analysis for data protection impact assessments in accordance with Art. 35 GDPR must still be carried out manually by a qualified person.

OTRIS has its strengths in document management. Contracts, files, investments, powers of attorney and directories are managed in a structured manner, retention periods are automated, and access rights are controlled in a fine-grained manner using role and group models. Points 3, 4 and 11 (directory according to Art. 30, order processing contracts according to Art. 28, audit trail with versioning) are mapped at a high enterprise level, including workflow engine and multi-stage release. Large corporations with their own corporate legal department and a strong file culture will find a suitable tool here that also maps large amounts of data and complex authorisation models.

The gap is at the operational level of the representative roles. Point 1, the appointment certificate with a § 38 BDSG-compliant form and § 5 BDSG obligation of confidentiality, is not an independent product, but a template in the contract module that must be filled out by the legal department itself. Point 7, the NIS-2 24/72 reporting path according to Section 32 of the BSI Act, is not shown as a workflow with an escalating deadline. Point 8, the ISMS with 93 controls according to ISO/IEC 27001:2022, can be represented via partner solutions or in-house development, not as an out-of-the-box module. Point 13, the interface matrix for the data protection officer, information security officer, money laundering officer, reporting office and works council, is conceivable in the DMS, but not preconfigured.

OTRIS is a strong backbone, not an officer-as-a-service. Anyone who already has the file function and is looking for an external appointment of representatives plus operational support will need a second provider. The reality in German medium-sized companies often looks exactly like this: OTRIS as a file base, next to an external law firm for the order, next to an Excel sheet for NIS-2. This works, but it is not integrated audit evidence or a consolidated control view. The licence costs of OTRIS also position the product clearly in the enterprise segment; For medium-sized companies with fewer than 500 employees, the total cost of ownership is often difficult to justify if the data protection and representative function is the primary field of application.

CIVAC is built for the 14 audit criteria. Point 1, the appointment certificate, is prepared for all 25 German agent roles and is issued within an SLA of two working days, compared to the two to six weeks of a classic personnel search or law firm mandate. Point 2, the reporting line, is documented in the workspace with a quarterly decision log and escalation path to the top management level. Points 3 to 5 are standard with version history. Point 6, the data breach register, runs with a visible 72-hour counter in accordance with Art. 33 GDPR. Point 7, the NIS 2 path, is shown as a workflow with 24-hour early warning and 72-hour follow-up notification in accordance with Section 32 of the BSI Act.

Point 8, the ISMS status according to ISO/IEC 27001:2022, runs with all 93 controls as an integrated module in the same tenant, without a separate tool. Point 9, training certificates, are versioned per role and employee group and can be exported as a signed PDF. Point 10, EU data residency, is contractually guaranteed with a subcontractor list. Point 11, audit trail with versioning, is system default. Point 12, substitution regulation, runs via the officer-as-a-service pool with a guaranteed response time. Point 13, interface matrix, is preconfigured for DSB, ISB, GwB, reporting office, AGG complaint office, works council. Point 14, control log, is standard quarterly with agenda and minutes.

The model is dual: Licence the workspace for your internal representatives, or have our representatives order it. The choice is reversible, the data remains in EU residence, the 490 audit templates can be used immediately. The auditor calls, the evidence is ready. Where CIVAC appears structurally different compared to DataGuard, another provider and OTRIS is in consolidation: one tenant, one reporting line, one audit trail for all 25 roles, with the same versioning and signature logic from data protection to the fire protection officer.

Three profiles can be derived from practice and cover most medium-sized and corporate constellations. Profile A, the tech scale-up with 80 to 300 employees, high cloud tool density and a pure data protection focus: another provider and CIVAC are serious options. another provider delivers API depth and continuous directory updates from the connected systems, CIVAC delivers the ordering plus scaling to additional roles. If NIS 2 impact is foreseeable, CIVAC wins through the integrated 24/72 reporting chain, because a subsequent bolt-on neither convinces in the audit nor runs operationally.

Profile B, the classic medium-sized company with 200 to 2,000 employees, several locations and production facilities: data protection, information security, fire protection, hazardous substances and dangerous goods run in parallel and are subject to different laws from the ArbSchG on the GefStoffV up to the ADR Convention. DataGuard covers data protection, OTRIS covers file management, the two do not complement each other systemically. CIVAC bundles 25 roles in one workspace; This significantly reduces the number of parallel contracts and separate audit trails. The order SLA of two working days is an operational lever if a role needs to be filled urgently, for example after a change in personnel or a report to the authorities.

Profile C, the DAX group or the KRITIS operators: OTRIS often remains the backbone file. CIVAC acts as an officer layer: external appointment of DPO, ISB, money laundering officer and incident officer, workspace for the internal roles, interface to the existing DMS via API. The 93 controls according to ISO/IEC 27001:2022 are then the common denominator that all those responsible start from. For a more in-depth view of the ISB role, the CIVAC ISB contribution with a list of obligations and an appointment certificate template for KRITIS operators in accordance with Section 30 of the BSI Act is suitable. Group-wide interface matrices and consolidated quarterly reports to the board of directors are standard in CIVAC and do not have to be set up using workarounds.

A change of provider in the compliance area is not a UI swap, but rather a process related to the regulatory authorities. Three points need to be clarified before the old system is switched off. Firstly, the handover of the directory in accordance with Art. 30 GDPR including the version history; When making inquiries, supervisory authorities require the status at any time in the last three years and do not accept a purely current view. Secondly, representation in ongoing proceedings with authorities or those affected; Data protection complaints according to Art. 77 GDPR continue without a break and create deadlines regardless of the change of provider. Thirdly, the certificate of appointment and the certificate of dismissal of the previous appointee; A change without formal dismissal and new appointment is ineffective and vulnerable to audit.

CIVAC takes over these three steps as standard onboarding within the two working days of the SLA. The list according to Art. 30 is imported via CSV or API, ongoing procedures are documented in a handover protocol, and the appointment certificate is issued at the same time as the predecessor is removed. Date, signature, filing, representation regulations: appointment certificate, signed, filed, verifiable. The training certificates from the past three years will also be imported and given a hash value in the new system.

Important: The person responsible remains the person responsible. Art. 24 GDPR and Section 130 OWiG link the obligations to the company management, not to the provider. A well-designed transition reduces risk, not eliminates it. This is precisely why audit trail continuity is the most important migration criterion, more important than the price difference in the first contract year or the appearance of the user interface. Anyone who changes during the ongoing process should communicate the process transparently with the responsible supervisory authority; The Berlin and Hamburg authorities have repeatedly signaled that a documented handover has a positive influence on the assessment of organisational maturity.

The evaluation of DataGuard, another provider, OTRIS and CIVAC along the 14 audit criteria does not show a blanket winner. It shows different geometries: DataGuard as a data protection service with its own software interface, another provider as data protection automation with API depth, OTRIS as an enterprise file with high contract competence, CIVAC as an officer layer plus a platform for all 25 roles with an integrated NIS 2 path. The question is not which logo is the best. The question is where your specific audit line lies and where the gaps are that will become visible in the next official appointment.

CIVAC operates as a compliance platform and officer-as-a-service. Licence the workspace for your internal representatives, or have our representatives order it. The dual model allows you to start with the lighter version and migrate when there are personnel changes, group expansion or new regulations such as the EU AI Act, without interrupting the audit trail. 490 audit templates, 93 ISO controls, 25 roles, EU data residency, two business day order SLA, single tenant. Others run compliance like a filing cabinet. We run it like software.

Turn reading into a mandate. Send a short sketch of your setup to info@civac.de or use the contact form on civac.de. A mapping session against your current provider status clears the 14 points in 45 minutes; The migration then runs against the two-working day SLA for the appointment certificate and the first workspace setup, including import of the existing directory and handover protocol. A written assessment of your risk profile according to the 14 criteria is part of the initial consultation and is then sent to your tenant as a signed PDF, with a specific recommendation per point as to whether a workspace licence, officer-as-a-service or the combination of both models is the economically and regulatory viable solution.