GDPR penetration testing companies: compared

GDPR penetration testing companies are pentest providers whose own pages mention the GDPR. This page is for teams that hold personal data and need testing evidence for Article 32. The table lists every provider in our dataset with a GDPR mention, in A to Z order. It is not a ranking, and no provider pays for position.

Each cell comes from the provider's own pages, with the date we checked. "Not published" means we found no statement.

What does GDPR ask for?#

GDPR does not name penetration testing. Article 32 asks controllers and processors to implement measures that give a level of security appropriate to the risk, and lists "a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing" (Article 32, checked 9 November 2026).

A pentest is one way to run that process for web apps, APIs and cloud systems that hold personal data. For the full reading of the article and what evidence to keep, see GDPR penetration testing: what Article 32 asks for on penetrationtestservices.com. The UK version of the rule has its own guidance from the ICO (ICO guide to data security).

Who needs a test and when?#

Teams that hold personal data in a login, a user database or an API need a way to test those systems. Common triggers are a customer data processing agreement that asks for test evidence, a new system that stores personal data, and a major change to an existing one.

Article 32 scales with risk. A small system with little personal data can need lighter testing. Write down how you decided.

What to ask providers#

A GDPR mention in the table does not answer these questions. Send them to each provider and keep the written replies.

1. Will your testers see real personal data? If yes, how do you limit it?
2. Which contract do you sign with us? If you act as a processor, does it meet Article 28?
3. Where do you store reports, captures and screenshots, and for how long?
4. Who at your company can open our report and evidence?
5. Do you use subcontractors or third-party tools that receive our data?
6. How do you delete test data and access keys after the test?
7. Does the report say which systems hold personal data and how the findings affect it?
8. Is a retest included, so you can show the fix?

What does a processing contract need?#

If a provider processes personal data for you, Article 28 applies. It says processing by a processor must be governed by a binding contract or other legal act that sets out the subject matter and duration, the nature and purpose of the processing, the type of personal data and the obligations and rights of the controller. The contract must also say the processor acts only on documented instructions from the controller (Article 28, checked 9 November 2026).

Ask your data protection adviser whether a pentest provider is a processor in your case. The answer depends on what the testers can reach. Using test accounts and fake data can remove the question.

Price drivers#

Most providers publish no price, so you will get a quote. Price depends on:

• Number of applications, APIs and environments
• Number of user roles to test
• Whether testers work on test data or a copy of production
• Report type, for example an extra summary for customers
• Retest terms

For published prices and their units, see penetration testing cost.

How to read the table#

A row appears when the provider's record lists GDPR among its compliance mentions, taken from its own pages. We do not check whether a provider meets GDPR, and the table does not say so. Read the Web, API, Cloud and AI apps columns to see what each provider tests, then check Delivery, Published price, Turnaround and Retest.

The table has no data residency column. We did not find a consistent, sourced statement of where each provider stores reports. Use question 3 above.

What does an auditor or customer check in the report?#

No rule sets one pentest report format for GDPR. A customer or a regulator reads the report as evidence that you test your security on a regular basis. The report should show the scope and date, the methods, the findings with severity, the fixes and a retest result. A report is a snapshot of one scope at one time and does not prove compliance.

Share a summary with customers, not raw exploit detail, and agree a safe channel first. Our guide to SOC 2 penetration testing providers has a similar evidence checklist.

Where to go next#

Compare providers across all frameworks on the compliance index or in the provider directory. Before you request quotes, read questions to ask a pentest provider.