Does GDPR apply to my US-based SaaS startup?

Yes. GDPR applies to any organization that processes personal data of EU residents, regardless of where the organization is located. If your SaaS product has users or customers in the EU, or if you process EU personal data on behalf of your customers, GDPR applies to you. The regulation's territorial scope is defined in Article 3 and explicitly covers non-EU companies that offer services to EU residents.

What is the biggest GDPR risk for SaaS startups?

The biggest practical GDPR risks for SaaS startups are: no Data Processing Agreements with customers who are data controllers, using AI tools or SaaS tools that process EU personal data without DPAs in place, no privacy notice at point of data collection, inadequate data subject rights process (especially deletion requests), and no documented legal basis for processing. The maximum GDPR fine is 4% of global annual revenue or €20 million, whichever is higher, but enforcement against small startups is typically focused on pattern violations, not one-off technical gaps.

Do I need to appoint a Data Protection Officer?

Not necessarily. A DPO is required only if you are a public authority, if your core activities involve large-scale systematic monitoring of individuals, or if your core activities involve large-scale processing of special categories of data (health, criminal records, etc.). Most B2B SaaS startups do not require a DPO. You should, however, designate someone internally as your GDPR point of contact, often a founder, legal counsel, or head of engineering.

What is a legal basis for processing under GDPR?

GDPR Article 6 requires that every processing activity has a documented legal basis. The six legal bases are: consent, contract performance, legal obligation, vital interests, public task, and legitimate interests. For B2B SaaS, the most common legal bases are contract performance (processing is necessary to deliver your service) and legitimate interests (processing serves a legitimate business purpose that is not overridden by the data subject's rights). Consent is the legal basis for marketing emails. Document your legal basis for each processing activity in your Records of Processing.

What must a GDPR-compliant privacy notice include?

A GDPR-compliant privacy notice must include: the identity and contact details of the data controller, the purposes and legal basis for each processing activity, the categories of data collected, the recipients or categories of recipients, any international data transfers and the transfer mechanism, the retention period for each data category, the data subject's rights (access, correction, deletion, portability, objection), the right to withdraw consent where consent is the legal basis, the right to lodge a complaint with a supervisory authority, and whether providing data is a statutory or contractual requirement.

GDPR compliance checklist for SaaS startups: what you actually need to do

GDPR compliance is not a one-time legal exercise, it is an ongoing operational program. For a SaaS startup, the practical work falls into three areas: getting your legal documents right, implementing the required technical controls, and building processes that keep you compliant as you grow.

GDPR compliance checklist for SaaS startups

This checklist covers all three. Work through it in order.

1. Establish your legal foundation

Determine if GDPR applies and in what capacity

Identify EU personal data in your systems: Do you have EU users, EU customers, or do your customers' EU-resident data flow through your platform?
Determine your role: Are you a Data Controller (you determine why and how data is processed) or a Data Processor (you process data on behalf of a controller)? Most B2B SaaS companies are both: controller for your own employees and marketing data, processor for your customers' data.
Identify joint controller relationships if applicable, Rare, but some data sharing arrangements create joint controller status

Records of Processing Activities (RoPA)

Create a RoPA: Required under GDPR Article 30 for most organizations. Document each processing activity with: purpose, legal basis, categories of data subjects, categories of personal data, recipients, retention period, and transfer mechanisms
Review and update the RoPA at least annually and when new processing activities start
Keep the RoPA available for supervisory authority inspection on request

Legal basis for each processing activity

Document a legal basis for every processing activity: No processing without a documented legal basis
Marketing emails → Consent (Article 6(1)(a))
Service delivery → Contract performance (Article 6(1)(b))
Compliance obligations → Legal obligation (Article 6(1)(c))
Product analytics, fraud prevention → Legitimate interests (Article 6(1)(f)), requires a balancing test documented in writing
Special categories (health, race, religion, etc.), require an additional basis under Article 9

2. Privacy notice and consent

Draft a GDPR-compliant privacy notice: Must include all required elements (controller identity, purposes, legal bases, rights, transfers, retention)
Post the privacy notice on your website: At minimum at registration, checkout, and in your footer
Ensure the notice is written in plain language: Technical or legal language that is difficult to understand is a GDPR violation
Cookie consent banner: If you use non-essential cookies (analytics, advertising), you need explicit prior consent via a compliant consent mechanism. Pre-ticked boxes are not valid consent.
Marketing consent: Explicit opt-in for marketing emails; do not pre-populate consent checkboxes
Consent records: Keep records of when and how consent was obtained for each individual; consent must be as easy to withdraw as to give
Age verification: If your service may be used by children under 16 (or lower age set by member state law), parental consent mechanisms are required

3. Data Processing Agreements

Create a DPA template for customers who are data controllers and send you personal data, they must execute a DPA with you before sending personal data
Sign DPAs with all vendors that process EU personal data on your behalf: Cloud providers (AWS, GCP, Azure all provide GDPR DPAs), email providers, support tools, analytics platforms, AI tools
Maintain a subprocessor list: GDPR requires you to disclose your subprocessors; maintain a public or customer-accessible list
Notify customers of new subprocessors: Your DPA should specify how and when you notify customers of new subprocessors
Review DPAs annually: Especially important as your subprocessor list grows or changes

4. International data transfers

Identify all cross-border data transfers: Where does EU personal data go? US cloud providers, US-based SaaS tools, US-based analytics?
Verify transfer mechanisms: Most US-based providers use Standard Contractual Clauses (SCCs). Verify your DPAs with US vendors include SCCs.
EU-US Data Privacy Framework: US companies certified under the DPF can receive EU personal data without SCCs. Verify if your vendors are DPF-certified.
Document transfers in your RoPA: Every cross-border transfer must be documented with the transfer mechanism
Binding Corporate Rules: If you have EU subsidiaries or operate across multiple countries within your own organization, BCRs may be required; consult legal counsel

5. Data subject rights

GDPR grants individuals eight rights. You must be able to respond to requests for each within one calendar month.

Right of access (Article 15): Process for providing individuals with a copy of their personal data
Right to rectification (Article 16): Process for correcting inaccurate personal data
Right to erasure / right to be forgotten (Article 17): Process for deleting personal data when requested; verify deletion propagates to backups and subprocessors
Right to restriction (Article 18): Process for restricting processing while disputes are resolved
Right to data portability (Article 20): Process for providing data in machine-readable format (JSON, CSV) where the legal basis is consent or contract
Right to object (Article 21): Process for handling objections to processing based on legitimate interests
Rights related to automated decision-making (Article 22): If you use automated decision-making with significant effects on individuals, implement the required safeguards
Verify you can respond within one month: Test your ability to locate, export, and delete a specific individual's data across all your systems, including subprocessors

Build a data subject request intake form: Do not rely on ad-hoc email requests. A form that routes requests to the right person and starts a timer is the minimum process.

6. Data breach response

72-hour clock starts when you discover the breach, not when it happened

Article 33 requires notification to your supervisory authority within 72 hours of becoming aware of a personal data breach, not 72 hours from when it occurred. If you discover a breach on a Friday evening, the clock is already running. Your incident response plan must account for this timeline explicitly.

72-hour notification requirement: If you discover a personal data breach, you must notify your supervisory authority within 72 hours of becoming aware (Article 33). This is not 72 hours from when the breach occurred, it is from when you discover it.
Individual notification: If the breach is likely to result in high risk to individuals, notify those individuals without undue delay (Article 34)
Data controller notification: If you are a Processor and suffer a breach, notify the Controller "without undue delay" so they can meet their 72-hour window
Breach log: Maintain a record of all data breaches, even those not reportable (Article 33(5))
Incident response plan includes GDPR: Your IR plan should explicitly address GDPR breach notification timelines and escalation

7. Technical controls

Pseudonymization and encryption at rest: Personal data should be pseudonymized where possible and encrypted at rest (Article 25, data protection by design)
Access controls: Minimum necessary access to personal data for all staff and systems
Data minimization: Collect only the personal data you actually need; do not collect data speculatively
Retention and deletion: Define retention periods for each data category; implement automated deletion or documented manual deletion at end of retention
Audit logging: Maintain logs of access to personal data for accountability
Privacy by design in product development: Data protection considerations are part of engineering design, not a post-launch review
AI tools: Ensure AI tools processing EU personal data have DPAs, training opt-outs where required, and are documented in your vendor list

8. AI tools and GDPR (2026 addition)

The proliferation of AI tools has created a new category of GDPR compliance work. See the complete AI tools and GDPR guide for detail.

Inventory all AI tools used by your team that may process personal data in prompts
Verify DPAs cover AI features: Not all vendor DPAs automatically cover AI features (especially recently added ones)
Check training opt-out status for each AI tool on the enterprise/business tier
Update privacy notice to disclose AI tool use where personal data is involved

9. Governance

Designate a GDPR contact: Named individual responsible for GDPR compliance; point of contact for supervisory authority and data subject requests
GDPR training for staff: All employees who handle personal data should understand their GDPR obligations; training completion documented
Annual compliance review: Review and update all GDPR documentation, DPAs, and controls at least annually
Data Protection Impact Assessment (DPIA): Required for high-risk processing activities (large-scale processing of special categories, systematic monitoring, novel technology use)

Running GDPR and SOC 2 together, so you satisfy both without doubling the compliance work, is exactly what a fractional CISO does instead of leaving it on your plate. Book a call to map your fastest path to both.

Want a security leader to run this?

Xorabyte is a fractional CISO for startups who can review your cloud for the gaps found first, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.