GDPR: The Complete Compliance Guide for IT and SaaS Companies

The General Data Protection Regulation (GDPR) is the European Union’s data protection law. It has applied since 25 May 2018 and protects personal data about people in the EU and the wider European Economic Area (EEA). For IT and SaaS companies it matters well beyond Europe: if you offer services to people in the EU, monitor their behaviour, or process data for EU business customers, the GDPR or its contractual requirements will reach you.

This guide is general information, not legal advice.

What is the GDPR?

The GDPR is a regulation, so it applies directly in every EU member state without national transposition. Member states add some details through national laws, for example on the age of consent for online services or on employee data.

Key definitions:

For a typical B2B SaaS company, you are usually a processor for the data your customers put into the product, and a controller for your own marketing, sales, billing, website analytics and employee data.

History and why it was introduced

The GDPR replaced the 1995 directive because the patchwork of national laws was out of date for cloud computing, social media and global data flows, and because enforcement was weak.

Proposed changes. The Digital Omnibus proposal of November 2025 would, among other things, extend the breach notification deadline to 96 hours with a single EU reporting point, clarify when pseudonymised data counts as personal data, and move cookie consent rules into the GDPR. These are proposals only. Until an amending regulation is adopted and published, the rules described in this guide apply.

Main objectives:

1. Protect people’s fundamental right to data protection.
2. Give people control over their personal data.
3. Create one set of rules across the EU so data can flow freely within it.
4. Make organisations accountable, with meaningful penalties.

Who needs to comply?

Territorial scope (Article 3)

The GDPR applies to:

1. Organisations established in the EU, for processing in the context of that establishment, wherever the processing happens.
2. Organisations outside the EU that process personal data of people in the EU when they: - offer goods or services to them, paid or free; or - monitor their behaviour in the EU, for example through tracking or profiling.

Signals that you are “offering” services to people in the EU include EU languages, EU currencies, EU shipping, or marketing aimed at EU countries. Merely having a website that people in the EU can access is not enough on its own.

Non-EU controllers and processors caught by Article 3(2) generally have to appoint an EU representative (Article 27), unless the processing is occasional and low-risk.

Is it mandatory?

Yes, for organisations within its scope. It is a binding law enforced by national data protection authorities (DPAs), such as the CNIL in France, the Irish Data Protection Commission and the German federal and state authorities.

Penalties (Article 83):

Authorities can also order processing to stop, require deletion, or suspend data transfers. Individuals can claim compensation (Article 82).

Key requirements

The 7 principles (Article 5)

Lawful bases (Article 6)

Every processing purpose needs one of six lawful bases: consent, contract, legal obligation, vital interests, public task or legitimate interests. For SaaS companies the common ones are:

• Contract: providing the service the user signed up for.
• Legitimate interests: security monitoring, fraud prevention, some B2B marketing (with a balancing test).
• Consent: non-essential cookies, some marketing emails, optional features.
• Legal obligation: tax and accounting records.

Special category data also needs a condition under Article 9.

Data subject rights (Articles 12 to 22)

Respond without undue delay and within one month, extendable by two further months for complex requests.

Other core duties

• Privacy by design and by default (Article 25).
• Processor contracts (Article 28): written terms covering instructions, confidentiality, security, sub-processors, assistance, deletion and audits.
• Records of processing activities (Article 30).
• Security of processing (Article 32): appropriate technical and organisational measures, such as encryption, pseudonymisation, resilience and regular testing.
• Breach notification (Articles 33 and 34): notify the supervisory authority within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk; tell affected people without undue delay if the risk is high. Processors must tell controllers without undue delay.
• Data protection impact assessments (Article 35) for high-risk processing, such as large-scale profiling or monitoring.
• Data protection officer (Articles 37 to 39) where core activities involve large-scale regular monitoring or large-scale special category data, and for public authorities.

International transfers (Chapter V)

Personal data can leave the EEA only with a valid mechanism:

• Adequacy decision for the destination country (for example the UK, Japan, South Korea, and the US for companies certified under the EU-US Data Privacy Framework).
• Standard contractual clauses (SCCs), with a transfer impact assessment.
• Binding corporate rules for transfers within a group.
• Limited derogations for specific situations.

India does not currently have an EU adequacy decision, so EU data transferred to Indian IT providers normally relies on SCCs.

How to implement GDPR

1. Map your data. List what personal data you collect, why, where it is stored, who you share it with and how long you keep it. This feeds your Article 30 records.
2. Determine your roles for each activity: controller, processor or joint controller.
3. Pick and document lawful bases for each purpose.
4. Update privacy notices for your website, app and employees.
5. Put a DPA in place with customers (as processor) and with your vendors (as controller or sub-processor). Publish a sub-processor list.
6. Review transfers and sign SCCs where needed; carry out transfer impact assessments.
7. Build rights handling: an intake route, identity checks, and tooling to find, export and delete a user’s data across systems.
8. Fix consent and cookies under the ePrivacy rules: no non-essential cookies before consent.
9. Strengthen security and write an incident response plan with a 72-hour notification path.
10. Set retention periods and automate deletion.
11. Run DPIAs for high-risk features, such as new AI or profiling features.
12. Train staff and assign ownership, appointing a DPO and EU representative if required.

Documentation and policies

• Records of processing activities (controller and processor versions)
• Privacy notices (website, product, employees, candidates)
• Data processing agreements and sub-processor list
• Standard contractual clauses and transfer impact assessments
• Legitimate interests assessments
• DPIAs
• Data retention schedule
• Data subject request procedure and log
• Breach response procedure and breach register (all breaches, including those not notified)
• Information security policy and evidence of Article 32 measures
• Consent records
• DPO appointment and EU representative agreement, where applicable

Audits, assessments and enforcement

There is no official GDPR certificate in wide use. Article 42 allows approved certification schemes, but few exist so far. Compliance is shown through:

• Your own accountability records, available to regulators on request.
• Customer audits of processors under Article 28.
• Supporting certifications such as ISO 27701 for privacy management and ISO 27001 for security.
• Regulatory investigations following complaints, breaches or authority-led inquiries. Cross-border cases are led by the authority where the company has its main EU establishment (the one-stop shop).

Cost

GDPR compliance cost depends on how much personal data you process and how sensitive it is. Main cost areas:

Benefits

• Access to EU customers, who expect GDPR-ready vendors.
• Faster procurement with a ready DPA, sub-processor list and security evidence.
• Lower breach impact through minimisation and retention.
• A strong base for other privacy laws such as India’s DPDP Act, Brazil’s LGPD and the UK GDPR.
• Greater user trust.

Risks of non-compliance

• Fines of up to 4% of worldwide annual turnover.
• Orders to stop processing or suspend transfers, which can halt a product.
• Compensation claims and collective actions.
• Lost EU contracts and failed vendor reviews.
• Reputational damage after public enforcement decisions.

Common mistakes

• Assuming GDPR doesn’t apply outside the EU. Article 3(2) catches many non-EU companies.
• Relying on consent for everything. Consent must be freely given and can be withdrawn. Contract or legitimate interests often fit better.
• Cookie banners that set trackers before consent, or make rejecting harder than accepting.
• No processor agreements with vendors such as analytics, email and support tools.
• Ignoring backups and logs when deleting data.
• Missing the 72-hour clock because no one knows who decides on notification.
• Copying a generic privacy notice that doesn’t describe your real processing.

Challenges for IT companies

• Being a processor and a controller at once, with different obligations for each.
• Deleting data across microservices, data warehouses, logs and backups.
• Sub-processor chains across cloud, email, analytics and AI providers, each needing contracts and transfer checks.
• Using customer data for AI features or analytics, which may need a new lawful basis and a DPIA.
• Supporting EU customers’ audits without exposing other customers’ information.

Best practices

• Keep a single, current data map and generate records and sub-processor lists from it.
• Build privacy into product design reviews.
• Offer self-service export and deletion in your product.
• Pseudonymise data in analytics and test environments.
• Default to EU data residency for EU customers where you can.
• Review vendors before they touch personal data.
• Test your breach response with a tabletop exercise.

Tools that help

How GDPR relates to other frameworks

Real-world examples

• Large fines. The Irish Data Protection Commission fined Meta EUR 1.2 billion in May 2023 over EU-US data transfers, the largest GDPR fine to date. The Luxembourg authority fined Amazon EUR 746 million in 2021 over its advertising practices.
• Cookie enforcement. France’s CNIL has issued repeated fines to major websites for making it harder to refuse cookies than to accept them.
• Illustrative scenario, not a real company: an Indian SaaS company signs its first German customer. It is asked for a DPA, SCCs, a sub-processor list, a description of security measures and its breach process. Having these ready shortens the procurement from months to weeks.

Frequently asked questions

Does the GDPR apply to companies outside the EU? Yes, if they offer goods or services to people in the EU or monitor their behaviour there, or if they process data on behalf of an EU-based controller (through contracts).

Is there a GDPR certification? Not in common use. Article 42 schemes exist but are rare. ISO 27701 and ISO 27001 are often used as supporting evidence.

What is the difference between a controller and a processor? The controller decides why and how data is processed. The processor acts on the controller’s instructions.

How quickly must a data breach be reported? To the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people.

Do we need a DPO? Only if your core activities involve large-scale regular and systematic monitoring of people, or large-scale special category data, or you are a public authority. Many companies appoint one voluntarily.

Do we need consent to process personal data? Not always. Consent is one of six lawful bases. Contract and legitimate interests are often more suitable.

What are the maximum GDPR fines? EUR 20 million or 4% of worldwide annual turnover, whichever is higher.

Can we store EU data in India or the US? Yes, with a valid transfer mechanism, such as standard contractual clauses or, for certified US companies, the EU-US Data Privacy Framework.

Is the GDPR being changed? Amendments proposed in the 2025 Digital Omnibus were still under negotiation in October 2026. Nothing changes until an amending regulation is adopted; this guide is reviewed when that happens.

Are IP addresses personal data? Often, yes, where they can be linked to a person.

Do B2B companies need to comply? Yes. Business contact details such as names and work emails are personal data.

Next steps

• Map your personal data and decide where you act as controller and as processor.
• Publish a DPA and sub-processor list for customers.
• Check transfers outside the EEA and put SCCs in place.
• Fix your cookie banner and consent records.
• Test that you can find, export and delete one user’s data across all systems.