Cut through the noise. Practical steps SaaS companies need to take to achieve and maintain GDPR compliance.
GDPR compliance is widely misunderstood. Many companies either over-engineer it, spending months on documentation that adds no real protection, or under-engineer it, treating a cookie banner as the sum total of their obligations. This guide covers what GDPR actually requires of SaaS companies, and what you can do to get compliant without losing your mind.
GDPR applies to any organisation that processes personal data of individuals in the European Economic Area (EEA), regardless of where the organisation is based. If you have EU customers, EU employees, or EU website visitors whose data you process, GDPR applies to you.
The UK has its own version, UK GDPR, which is substantially equivalent to EU GDPR following Brexit. If you operate in both markets, you need to comply with both, though in practice the requirements are nearly identical.
GDPR distinguishes between data controllers (who determine the purpose and means of processing) and data processors (who process data on behalf of controllers). Most SaaS companies are both, a controller for their own customer data, and a processor for data their customers store in their platform.
Every processing activity must have a lawful basis. The six lawful bases are: consent, contract, legal obligation, vital interests, public task, and legitimate interests. For most SaaS companies, the relevant bases are contract (processing necessary to deliver your service), legitimate interests (analytics, security monitoring), and consent (marketing communications).
Consent under GDPR must be freely given, specific, informed, and unambiguous. Pre-ticked boxes, bundled consent, and vague descriptions do not meet the standard. If you rely on consent, you must also provide an easy way to withdraw it.
Legitimate interests is a flexible basis but requires a balancing test, you must weigh your interests against the rights and expectations of the individuals whose data you process. Document this assessment.
Privacy notices must be clear, concise, and accessible. They must explain what data you collect, why, how long you keep it, who you share it with, and what rights individuals have. Plain English is not just good practice, it is a requirement.
Data subject rights include the right to access, rectification, erasure, restriction, portability, and objection. You must be able to respond to these requests within one month. Build the processes to handle them before you receive them.
Data Processing Agreements (DPAs) are required whenever you share personal data with a third-party processor, your cloud provider, analytics platform, email service, and so on. Most major vendors provide standard DPAs; ensure you have them in place.
Transferring personal data outside the UK or EEA requires an appropriate safeguard. For transfers to the US, the UK-US Data Bridge and EU-US Data Privacy Framework provide mechanisms for compliant transfers with certified organisations. Standard Contractual Clauses (SCCs) are the most widely used mechanism for other transfers.
Review your sub-processors, the third-party services your platform relies on, and ensure appropriate transfer mechanisms are in place for any that process data outside the UK or EEA.
Every processing activity must have a documented lawful basis, contract, legitimate interests, consent, legal obligation, vital interests, or public task.
Clear, accessible notices explaining what data is collected, why, how long it is kept, who it is shared with, and individual rights.
Processes to handle access, rectification, erasure, restriction, portability, and objection requests within one month.
Written agreements with all third-party processors covering the subject matter, duration, nature, and purpose of processing.
Notification to the ICO within 72 hours of becoming aware of a breach likely to result in risk to individuals.
A Record of Processing Activities (RoPA) documenting all processing activities, required for organisations with 250+ employees or processing high-risk data.
Identify all personal data flows, what data you collect, where it comes from, where it goes, and how long you keep it.
Document the lawful basis for each processing activity and conduct legitimate interests assessments where required.
Develop privacy notices, cookie policies, data retention schedules, and the Record of Processing Activities.
Audit third-party processors, put Data Processing Agreements in place, and address international transfer mechanisms.
Build and test processes for handling data subject rights requests, including access, erasure, and portability.
Establish a privacy governance programme, regular reviews, staff training, breach response procedures, and DPIAs for high-risk processing.
Netru methodology