An essential guide to GDPR compliance for SaaS companies

If your SaaS platform collects, processes, or stores EU residents’ data, GDPR compliance is essential to avoid regulatory issues, legal escalations, and operational interruptions. 

‍

Due to GDPR’s comprehensive nature, ensuring compliance can be challenging—especially without adequate guidance.

‍

This guide provides granular information to help you start working toward GDPR compliance as a SaaS platform owner. We’ll cover:

• The impact of GDPR on SaaS solutions
• The relevant data principles to be aware of
• Steps to make your SaaS solution GDPR-compliant

‍

How does the GDPR impact your SaaS platform?

The GDPR imposes numerous rules on SaaS platforms that collect or process EU citizens’ personal data, regardless of the company’s domicile. The regulation distinguishes between two types of entities required to comply:

1. Data controller: Determines the scope, purpose, and means of data processing. The controller also makes any executive decisions regarding the processing procedures.
2. Data processor: Directly engages in processing activities on behalf of the data controller under the terms and circumstances defined by them.

‍

The GDPR requirements for each category can vary, though they share considerable overlaps in key obligations (e.g., both can be held liable for data breaches and other significant security concerns). With over 100,000 data breaches reported annually in recent years, the GDPR impact on your SaaS platform is clear.

‍

In some cases, your organization can be both the data controller and processor, though this can’t happen for the same processing activity. To avoid misunderstandings, consider the factors above regarding controller and processor distinctions to determine your role for a given processing activity.

‍

GDPR data principles your SaaS app must follow

The GDPR is built on seven data principles that form the foundation for all GDPR compliance efforts and ensure that organizations handle data in a transparent, secure, and accountable way. We’ve outlined them in the following table:

‍

‍

The GDPR prescribes numerous controls your organization must implement to ensure your software’s adherence to these principles. To implement them effectively, consider these steps:

1. Establish a legal basis for processing
2. Build robust data protection into your software
3. Ensure adequate processing security
4. Assisting controllers in fulfilling data subject rights
5. Assist controllers in performing a data protection impact assessment (DPIA)
6. Support controllers with incident response and breach notification
7. Maintain records of processing activities

‍

Below we’ll elaborate on each step in more detail.

‍

{{cta_withimage14="/cta-blocks"}}

‍

Step 1: Establish a legal basis for processing

Under the GDPR, establishing a legal basis for processing data is the responsibility of data controllers, who determine why and how personal data is processed. For those SaaS companies that primarily act as data processors, that means they process data on behalf of data controllers (their customers), and do not choose the legal basis for processing.

‍

The processor’s main responsibility is to ensure that a GDPR-compliant Data Processing Agreement (DPA) is in place with each controller. This contract defines the processor’s responsibilities, ensuring that data is processed based on the controller’s instructions and GDPR requirements. 

‍

At a minimum, here are the characteristics that a DPA should include:

• The subject matter, nature, and purpose of processing
• The types of personal data processed
• The duration of processing activities
• Obligations of the controller and processor
• Sub-processing requirements (if applicable)
• A commitment to implement security measures in line with Article 32
• A defined process for assisting controllers in handling data subject rights and breach notifications

‍

Data processing lawfulness can be a complex topic, especially for SaaS companies that also act as controllers in specific areas. There are additional circumstances and details you should familiarize yourself with, such as “special category” (or sensitive) personal data, the processing of which requires a separate set of conditions. You can refer to the GDPR Article 6 and Article 9 for more information.

‍

Step 2: Build robust data protection into your software

Article 25 of the GDPR introduces the concept of data protection by design and by default. This means privacy and security must be built into the data collection and processing activities and the solutions performing them.

‍

This requirement is particularly important for SaaS companies because it can significantly impact your product development cycle. You must consider data protection early to ensure the solution meets the GDPR’s standards.

‍

Specifically, you must implement various effective technical and organizational data protection measures, such as:

• Pseudonymization
• End-to-end encryption
• Role-based access controls (RBAC)
• Audit logging
• Data retention and deletion controls. 

‍

You must also develop measures to ensure that all processed data serves a specific purpose and isn’t accessible without an individual’s direct intervention.

‍

Step 3: Ensure adequate processing security

All tools and processes involved in data collection, processing, and storing must contain adequate security measures that prevent internal and external incidents. The extent of these measures must align with the level of risk to which personal data is exposed.

‍

Some of the main security measures prescribed by the GDPR include:

• Encryption, pseudonymization, and similar technical measures
• Ongoing ability to ensure confidentiality, resilience, integrity, and availability of processing services and systems
• Effective backup and restoration mechanisms in case of incidents
• A comprehensive process for testing technical and organizational security measures to evaluate their effectiveness, such as penetration testing and vulnerability scanning

‍

Since the security measures you need to implement depend on your organization’s risk profile, you must first conduct a comprehensive risk assessment to identify all significant threats to data security and privacy, such as:

• Cyberattacks
• Unauthorized access
• Third-party risks
• Disasters that can damage data servers

‍

After uncovering all potential risks, rank them based on their severity and likelihood of occurrence. Doing so enables effective risk prioritization and lets you focus your resources on the most impactful mitigation strategies.

‍

Step 4: Assisting controllers in fulfilling data subject rights

GDPR lists several rights data subjects have regarding how their data is collected and stored, including:

• Access: The data subject has the right to a confirmation that their data is processed. If so, they should be able to access the data and related information (processing purposes, data categories, etc.).
• Rectification: The data subject can require rectification of incorrect data and updates to any incomplete information.
• Erasure: The data subject can request the erasure of their personal information under specific circumstances (the data is no longer necessary, the subject has withdrawn consent, etc.).
• Restriction of processing: The data subject can require the controller to restrict the processing of their data if they contest its accuracy, deem the processing unlawful, object to processing, or if the controller no longer needs the data for the defined purpose.
• Objection: The data subject can object to data processing due to their specific interest, in which case the controller must prove that processing overrides those interests.

‍

Even though controllers are the ones responsible for responding to data subject requests, as a processor, your SaaS platform needs to be equipped to assist controllers in doing so by:

• Offering built-in features to allow deletion, rectification, and export of data (Data Portability)
• Ensuring contracts specify clear response timelines, so controllers can comply with GDPR deadlines

‍

Additional details on these rights you should know about are outlined in Chapter 3.

‍

{{cta_withimage14="/cta-blocks"}}

‍

Step 5: Assist controllers in performing a data protection impact assessment (DPIA)

A data protection impact assessment (DPIA) is a systematic review of data processing activities and their risks to an organization’s ability to protect the collected data. DPIAs are only required for controllers, in cases when data processing is likely to result in a high risk to the rights and freedoms of natural persons, including but not limited to under the following circumstances:

• The organization processes special categories of sensitive data (as defined in Article 9) or of data on criminal convictions and offenses on a large scale
• Automated processing activities involving the systematic and extensive evaluation of personal aspects of data subjects, including profiling, and on which decisions are based that produce legal effects or similar consequences
• The organization systematically performs large-scale monitoring of publicly accessible areas

‍

If any of these conditions are met, controllers must conduct a DPIA that includes at least the following elements:

• A complete description of the processing activities and their purposes
• An assessment of the necessity of processing and its proportionality to the defined purpose
• A risk assessment regarding the data subjects’ rights and freedom
• The risk mitigation measures the controller plans to implement

‍

While controllers are responsible for conducting DPIAs, processors must support them by providing detailed information about their processing activities. This includes documenting their data flows and security measures to help controllers meet their DPIA requirements. 

‍

One way to simplify this process and ensure GDPR compliance is by maintaining a Transparency Statement, which outlines what personal data is collected, how it’s processed, and which third parties (if any) it’s shared with. 

‍

Step 6: Support controllers with incident response and breach notification

As per Article 33, if you are a controller, you must notify the supervisory authority of a data breach no longer than 72 hours after becoming aware unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the notification is submitted later, the reason for the delay must also be stated. 

‍

As a processor, you must notify the controller of a data breach without undue delay and provide all relevant information necessary to help them meet their 72-hour notification deadline to regulators. For this reason, clearly defining timelines, roles, and communication procedures in DPAs is crucial.

‍

If the breach is likely to put the rights and freedoms of data subjects (natural persons) at risk, the controller must also notify them and describe the nature of the breach. The only situations in which there’s no obligation to notify data subjects are as follows:

• You’ve implemented security measures that effectively make the data unintelligible to unauthorized users
• You’ve taken subsequent protection measures that minimize the risks to the rights and freedoms of data subjects
• The notification would involve disproportionate effort, in which case you can release a public statement instead

‍

Your incident response plan must account for these requirements. As you develop it, plan how you’ll communicate data breaches to the necessary parties.

‍

Step 7: Maintain records of processing activities

Article 30 of the GDPR obligates data controllers and processors to maintain detailed records of data processing activities. This request highlights the difference between controllers and processors as the information to include in the records varies slightly.

‍

Data controllers must maintain more robust records that include key information, such as:

• Purposes of data processing
• Categories of data subjects and processed data
• Categories of the recipients of processed data
• Erasure timeframes for specific categories of data
• A high-level description of data security measures

‍

Processors and their representatives who perform processing activities on behalf of the controller must maintain similar records, though they don’t have to include components like processing purposes. They have to keep records of categories of processing activities completed for each controller and keep track of any subprocessors used, which can be challenging if many of them exist.

‍

Ensure streamlined GDPR compliance with Vanta

Due to the many complexities of the GDPR, the resulting compliance workflows can overwhelm SaaS security teams. To simplify the process as much as possible, you can leverage a capable software solution like Vanta—an end-to-end trust management platform.

‍

Vanta automates numerous GDPR compliance activities to let you enjoy a more streamlined and worry-free experience. The platform’s dedicated GDPR product offers various features that enable these advantages, most notably:

• A comprehensive technical and organizational controls list
• Policy builder with useful templates (DPIA template, cookie policy template, etc.)
• Streamlined inventory management for comprehensive asset monitoring
• Automated evidence collection supported by over 375 integrations with popular software
• GDPR training that fosters organization-wide compliance

‍

Schedule a custom demo of Vanta’s GDPR product to see its features first-hand and find out how it helps your SaaS solution ensure efficient compliance.

‍

{{cta_simple19="/cta-blocks"}}

‍

A note from Vanta: Vanta is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.