# GDPR penetration testing companies: compared

Source: https://pentestcompare.com/compliance/gdpr/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

GDPR penetration testing companies from one sourced dataset, A to Z. Article 32 in plain words, data handling questions and what to ask before you sign.

> **Short answer:** GDPR does not name penetration testing. Article 32 asks controllers and processors to have a process for regularly testing and evaluating their security measures, and a pentest can be part of that process. The table lists providers whose own pages mention GDPR, A to Z. A mention is not proof of fit. Ask each provider where it stores your test data and who signs the processing contract.

GDPR penetration testing companies are pentest providers whose own pages mention the GDPR. This page is for teams that hold personal data and need testing evidence for Article 32. The table lists every provider in our dataset with a GDPR mention, in A to Z order. It is not a ranking, and no provider pays for position.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [CYBRI](https://pentestcompare.com/providers/cybri/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | $5,000 starts at, per engagement | From 5 business days (Web Application and Custom), 10 (Web, API, Cloud or AI), 15 (Multiple Apps). | Remediation testing is included in the $9,500 and $20,000 tiers. Unlimited remediation testing with an extended window is listed as an add-on. The Web Application tier does not state it. | not published |
| [DeepStrike](https://pentestcompare.com/providers/deepstrike/) | Penetration testing consultancy | human-led | yes | unknown | yes | unknown | custom quote | Basic plan: start pentest within 48 hours. | The services page says free unlimited re-testing; the pricing page says free remediation retesting for 12 months. Both are shown. | not published |
| [Detectify](https://pentestcompare.com/providers/detectify/) | Application security platform | automated | yes | yes | unknown | unknown | from EUR 0 per year (annual platform fee) | Not published | Not stated on the pricing page. | not published |
| [Giskard](https://pentestcompare.com/providers/giskard/) | AI-assisted testing service | hybrid | unknown | yes | unknown | yes | $0 no billing unit given | Not published | Giskard says it re-runs every test until the fix is confirmed. | not published |
| [HackerOne](https://pentestcompare.com/providers/hackerone/) | Crowdsourced platform | hybrid | yes | yes | yes | yes | custom quote | Product page gives no start time or test length. HackerOne docs list the final report 3-5 business days after testing ends. | Retesting is included after remediation. Docs say unlimited retests during the remediation period (typically 30 or 90 days) at no extra cost, usually completed within 72 hours once claimed; after the window a fee (minimum $50) can be set. Older docs and posts show 60-day / two-retest wording. | not published |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Pentest-Tools.com](https://pentestcompare.com/providers/pentest-tools/) | Vulnerability scanning and pentest platform | hybrid | yes | yes | yes | yes | from $96 per month, 16 assets | Not published | Unlimited rescans on all paid plans (tool scans). | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request |
| [ZeroThreat](https://pentestcompare.com/providers/zerothreat/) | Autonomous testing platform | automated | yes | yes | partial | unknown | $100 per target per month | Not published | Professional: unlimited retesting. Pay Per Scan: unlimited retesting within 7 days. Free: not included. | not published |

Each cell comes from the provider's own pages, with the date we checked. "Not published" means we found no statement.

## What does GDPR ask for?

GDPR does not name penetration testing. Article 32 asks controllers and processors to implement measures that give a level of security appropriate to the risk, and lists "a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing" ([Article 32](https://gdpr-info.eu/art-32-gdpr/), checked 9 November 2026).

A pentest is one way to run that process for web apps, APIs and cloud systems that hold personal data. For the full reading of the article and what evidence to keep, see [GDPR penetration testing: what Article 32 asks for](https://penetrationtestservices.com/guides/gdpr-penetration-testing/) on penetrationtestservices.com. The UK version of the rule has its own guidance from the ICO ([ICO guide to data security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/)).

## Who needs a test and when?

Teams that hold personal data in a login, a user database or an API need a way to test those systems. Common triggers are a customer data processing agreement that asks for test evidence, a new system that stores personal data, and a major change to an existing one.

Article 32 scales with risk. A small system with little personal data can need lighter testing. Write down how you decided.

## What to ask providers

A GDPR mention in the table does not answer these questions. Send them to each provider and keep the written replies.

1. Will your testers see real personal data? If yes, how do you limit it?
2. Which contract do you sign with us? If you act as a processor, does it meet Article 28?
3. Where do you store reports, captures and screenshots, and for how long?
4. Who at your company can open our report and evidence?
5. Do you use subcontractors or third-party tools that receive our data?
6. How do you delete test data and access keys after the test?
7. Does the report say which systems hold personal data and how the findings affect it?
8. Is a retest included, so you can show the fix?

## What does a processing contract need?

If a provider processes personal data for you, Article 28 applies. It says processing by a processor must be governed by a binding contract or other legal act that sets out the subject matter and duration, the nature and purpose of the processing, the type of personal data and the obligations and rights of the controller. The contract must also say the processor acts only on documented instructions from the controller ([Article 28](https://gdpr-info.eu/art-28-gdpr/), checked 9 November 2026).

Ask your data protection adviser whether a pentest provider is a processor in your case. The answer depends on what the testers can reach. Using test accounts and fake data can remove the question.

## Price drivers

Most providers publish no price, so you will get a quote. Price depends on:

- Number of applications, APIs and environments
- Number of user roles to test
- Whether testers work on test data or a copy of production
- Report type, for example an extra summary for customers
- Retest terms

For published prices and their units, see [penetration testing cost](/guides/penetration-testing-cost/).

## How to read the table

A row appears when the provider's record lists GDPR among its compliance mentions, taken from its own pages. We do not check whether a provider meets GDPR, and the table does not say so. Read the Web, API, Cloud and AI apps columns to see what each provider tests, then check Delivery, Published price, Turnaround and Retest.

The table has no data residency column. We did not find a consistent, sourced statement of where each provider stores reports. Use question 3 above.

## What does an auditor or customer check in the report?

No rule sets one pentest report format for GDPR. A customer or a regulator reads the report as evidence that you test your security on a regular basis. The report should show the scope and date, the methods, the findings with severity, the fixes and a retest result. A report is a snapshot of one scope at one time and does not prove compliance.

Share a summary with customers, not raw exploit detail, and agree a safe channel first. Our guide to [SOC 2 penetration testing providers](/guides/soc-2-penetration-testing-providers/) has a similar evidence checklist.

## Where to go next

Compare providers across all frameworks on the [compliance index](/compliance/) or in the [provider directory](/directory/). Before you request quotes, read [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/).

## Questions

### Does a provider that mentions GDPR make me compliant?

No. A GDPR mention on a provider's page shows it talks about the regulation. Compliance is your duty as a controller or processor, and a pentest report is one piece of evidence. Do not tell a customer or regulator that a report makes you compliant.

### Does the pentest provider process my personal data?

It may. If testers can see real user records, the provider may act as your processor, and Article 28 asks for a contract that binds it. Use test data where you can. If real data is in scope, ask your data protection adviser which role applies.

### Should the report stay inside the EU?

GDPR does not say reports must stay in one region, but it sets rules for transfers of personal data outside the EU. A report can hold personal data, such as names in screenshots. Ask where the provider stores reports and captures, and who can open them.

### How often should I test for GDPR purposes?

The text sets no interval. Article 32 asks for regular testing, and you decide what regular means for your risk. Write the reasoning down. Many teams also test after major changes to systems that hold personal data.

## Sources

- [GDPR Article 32: Security of processing](https://gdpr-info.eu/art-32-gdpr/)
- [GDPR Article 28: Processor](https://gdpr-info.eu/art-28-gdpr/)
- [EUR-Lex: Regulation (EU) 2016/679 (official text)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [ICO: A guide to data security (UK GDPR)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/)
- [PentestCompare provider dataset (filter: GDPR)](https://pentestcompare.com/data/providers.json)