GDPR Checklist
GDPR compliance for SaaS startups
SaaS products collect account data, usage analytics, and often payment info — putting GDPR squarely in scope from day one.
Common risks
- • Tracking analytics before cookie consent is collected
- • No documented legal basis for processing customer data
- • Missing Data Processing Agreements with sub-processors (Stripe, analytics, email)
- • No self-serve data export or account deletion
Your checklist
- Publish a privacy policy covering Art. 13/14 disclosures
- Add a cookie consent banner that blocks non-essential cookies until consent
- List all sub-processors and sign DPAs with each
- Implement data export (Art. 20) and account deletion (Art. 17)
- Define and document data retention periods (Art. 5(1)(e))
- Encrypt personal data at rest and in transit (Art. 32)
- Keep a Record of Processing Activities (Art. 30)
FAQs
Does GDPR apply to my SaaS if I'm not in the EU?
Yes. GDPR applies to anyone processing the personal data of people in the EU, regardless of where your company is based.
Do I need a DPO?
Most small SaaS companies don't, unless your core activity is large-scale monitoring or processing of special-category data. You still must meet all other obligations.