GDPR compliance requirements for SaaS and IT

The GDPR (General Data Protection Regulation, Regulation (EU) 2016/679) is the European Union law that governs how organizations process personal data about people. It has applied since 25 May 2018 across the EU and the wider European Economic Area. It reaches companies outside the EU when they offer goods or services to people in the EU or monitor their behavior there.

For software and IT companies, the GDPR shows up in two roles: as the controller of your own customer, user, marketing and employee data, and as the processor of personal data your customers put into your product. This guide explains both roles, the duties attached to each, and how to show you meet them. Article numbers are given so you can check each point against the official text on EUR-Lex, linked in the sources.

The GDPR regulates the processing of personal data. Both terms are broad:

Personal data is any information relating to an identified or identifiable living person (Article 4(1)). Names and emails, but also IP addresses, device IDs, cookie identifiers, location data, employee IDs and support tickets that mention a person.
Processing is anything done with personal data, automated or not: collecting, storing, using, analyzing, sharing, deleting (Article 4(2)).

Some data gets extra protection. Special category data, such as health, biometric data used for identification, racial or ethnic origin, religious beliefs, sexual orientation, political opinions and trade union membership, may only be processed under one of the conditions in Article 9. Data about criminal convictions has its own rule in Article 10.

The GDPR is a regulation, so it applies directly in every member state. National laws fill in specific areas it leaves open, such as the age of consent for online services (between 13 and 16, Article 8), employee data and some exemptions. Each country has a supervisory authority that enforces it, and the European Data Protection Board (EDPB) issues guidelines and resolves cross-border disputes.

Yes. The GDPR is binding law. If it applies to you, compliance is mandatory, and supervisory authorities can investigate, order changes, ban processing and fine. Individuals can also complain to an authority or claim compensation in court (Articles 77 to 82).

There is no GDPR certificate that proves compliance. Article 42 allows approved certification schemes, but few exist and none is required. What the GDPR requires is that you comply and can demonstrate it, which is the accountability principle in Article 5(2).

Plain answer: if you have users, customers or employees in the EU, or you process personal data for customers who do, the GDPR almost certainly applies to you and compliance is not optional.

Article 3 sets the territorial scope. The GDPR applies to:

Organizations established in the EU, for processing in the context of that establishment, wherever the processing happens. An EU subsidiary or office counts.
Organizations outside the EU that process personal data of people in the EU when the processing relates to:
- offering goods or services to them, paid or free, or
- monitoring their behavior in the EU, such as tracking, profiling or behavioral advertising.

Merely having a website that people in the EU can reach does not make you subject to the GDPR. Signs that you target EU users include EU languages or currencies, EU shipping, EU marketing, or naming EU customers. The EDPB's guidelines 3/2018 on territorial scope give worked examples.

A non-EU company caught by Article 3(2) must usually appoint a representative in the EU under Article 27, unless its processing is occasional, low risk and does not involve large-scale special category data.

Controller or processor?

Your duties depend on your role for each processing activity:

A controller decides why and how personal data is processed. A SaaS company is the controller of its own account, billing, marketing, website analytics and HR data.
A processor processes personal data on behalf of a controller. A SaaS company is usually the processor for the data customers put into the product.
A sub-processor is a processor engaged by another processor, such as your cloud hosting provider or email delivery service.

One company can be both, for different data. Map your role per activity, because it decides which articles apply.

Enterprise sales depend on it. EU customers must, under Article 28, only use processors that give sufficient guarantees. Expect a data processing agreement, a sub-processor list, security documentation and transfer details in every deal.
Fines are large and public. The highest fine so far was 1.2 billion euros, imposed on Meta Platforms Ireland by the Irish Data Protection Commission in May 2023 over transfers of personal data to the US.
Processors have direct duties. Unlike older laws, the GDPR places obligations and fines directly on processors, including security, records, breach notice to the controller and sub-processor rules.
It shapes product design. Data protection by design and by default (Article 25) means privacy settings, retention controls, deletion and export features are expected in the product.
Other laws copy it. India's DPDP Act, Brazil's LGPD, the UK GDPR and many others borrow its concepts, so a GDPR program gives you a head start elsewhere.

Article 5 sets seven principles. Every processing activity must meet all of them.

Principle	What it means in practice
Lawfulness, fairness and transparency	Have a lawful basis, do not process in ways people would not expect, and tell them clearly what you do.
Purpose limitation	Collect for specified, explicit purposes and do not reuse data for an incompatible purpose.
Data minimization	Collect only what is adequate, relevant and necessary for the purpose.
Accuracy	Keep data accurate and up to date, and correct or delete inaccurate data.
Storage limitation	Keep identifiable data no longer than necessary. Set and apply retention periods.
Integrity and confidentiality	Protect data with appropriate security against unauthorized processing, loss or damage.
Accountability	Be responsible for compliance and be able to demonstrate it with records.

Article 6 lists six lawful bases. You need at least one for each purpose, chosen before you start, and you must name it in your privacy notice.

Consent: freely given, specific, informed and unambiguous, and as easy to withdraw as to give (Articles 4(11) and 7). Common for marketing emails and non-essential cookies. Rarely the right basis for employee data or for core service delivery.
Contract: processing necessary to perform a contract with the person, or to take steps at their request before entering one. Typical for running a user's account.
Legal obligation: processing required by EU or member state law, such as tax records.
Vital interests: protecting someone's life. Rare in IT.
Public task: for public authorities and bodies carrying out official functions.
Legitimate interests: necessary for your or a third party's legitimate interests, unless overridden by the person's interests and rights. Requires a documented balancing test. Often used for security monitoring, fraud prevention and some analytics.

Cookies and similar trackers on devices are also governed by the ePrivacy Directive and national laws, which generally require consent for non-essential storage or access, whatever GDPR basis you then use for the data.

Articles 12 to 22 give individuals (data subjects) rights you must be able to honor, usually within one month of the request, extendable by two further months for complex or numerous requests (Article 12(3)).

Right	Article	What your product and team must do
To be informed	13, 14	Provide a clear privacy notice at collection, or within a month if data came from elsewhere.
Access	15	Confirm processing and provide a copy of the data plus key information.
Rectification	16	Correct inaccurate data.
Erasure	17	Delete data when a ground applies, such as withdrawn consent or no longer necessary.
Restriction	18	Pause processing while accuracy or an objection is checked.
Data portability	20	Export data the person provided in a structured, machine-readable format, when based on consent or contract.
Object	21	Stop processing based on legitimate interests unless you have compelling grounds, and always stop direct marketing.
Automated decisions	22	Do not make solely automated decisions with legal or similarly significant effects, except under listed conditions with safeguards.

As a processor, you usually do not answer requests directly. Article 28(3)(e) requires you to help the controller respond, which in practice means in-product export, correction and deletion tools, and a support process for the rest.

What must controllers and processors do?

Controller duties

Implement appropriate measures and be able to show compliance (Article 24).
Build data protection in by design and by default (Article 25).
Use only processors that give sufficient guarantees, under a written contract (Article 28).
Keep records of processing activities (Article 30). Organizations with fewer than 250 employees are exempt only if their processing is occasional, unlikely to result in a risk and excludes special category and criminal data, which rarely fits a software business.
Run a data protection impact assessment before high-risk processing (Article 35), such as large-scale profiling, systematic monitoring or large-scale special category data.
Appoint a data protection officer where Article 37 requires one: public bodies, and organizations whose core activities involve large-scale regular and systematic monitoring or large-scale special category data.

Processor duties

Process only on the controller's documented instructions (Articles 28(3)(a) and 29).
Ensure people authorized to process the data are bound by confidentiality (Article 28(3)(b)).
Implement Article 32 security.
Engage sub-processors only with the controller's prior authorization, and flow down the same obligations (Article 28(2) and (4)).
Assist the controller with rights requests, security, breach notification and DPIAs (Article 28(3)(e) and (f)).
Delete or return data at the end of the service (Article 28(3)(g)).
Make available the information needed to demonstrate compliance and allow audits (Article 28(3)(h)).
Keep your own records of processing as a processor (Article 30(2)).
Notify the controller of a breach without undue delay (Article 33(2)).

Article 28(3) lists the terms every data processing agreement must contain. Most SaaS companies publish a standard DPA based on those terms, along with a list of sub-processors and a process for notifying customers of changes.

Article 32 requires controllers and processors to implement technical and organizational measures that give a level of security appropriate to the risk, taking into account the state of the art, costs, and the nature, scope, context and purposes of processing. It lists examples:

Pseudonymization and encryption of personal data.
The ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services.
The ability to restore availability and access to data in a timely manner after an incident.
A process for regularly testing, assessing and evaluating the effectiveness of the measures.

The GDPR does not name a security standard. Many companies use ISO 27001, with ISO 27701 for privacy management, to show their measures are appropriate. Article 32(4) also requires steps to ensure that anyone acting under your authority with access to personal data only processes it on instructions, which is one reason training is part of security.

Breach notification

A personal data breach is a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data (Article 4(12)).

Controllers must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people (Article 33). If notice is later than 72 hours, explain the delay.
Controllers must tell affected individuals without undue delay when the breach is likely to result in a high risk to them (Article 34).
Processors must notify the controller without undue delay after becoming aware (Article 33(2)). Customer contracts often set a specific number of hours.
Every breach must be documented internally, including those not notified (Article 33(5)).

Personal data may leave the EEA only under Chapter V (Articles 44 to 49). For software companies, remote access from another country counts as a transfer, so support teams and offshore developers matter as much as server location.

Adequacy decisions (Article 45). The European Commission has found some countries adequate, including the UK, Switzerland, Japan, South Korea and others. For the United States, the EU-US Data Privacy Framework adequacy decision of July 2023 covers transfers to US companies that self-certify to it. The EU General Court dismissed a challenge to it in September 2025, and an appeal is pending before the Court of Justice.
Standard contractual clauses (Article 46). The Commission's 2021 SCCs are the most common tool for transfers to countries without adequacy, including India. Since the Schrems II judgment (case C-311/18, 2020), you must also assess whether the law of the destination country undermines the clauses and add supplementary measures where needed.
Binding corporate rules (Article 47) for transfers within a corporate group, approved by a supervisory authority.
Derogations (Article 49), such as explicit consent, for occasional transfers only.

The GDPR does not contain a single article that says "train every employee every year". Training is still expected, through several duties that are hard to meet without it:

Accountability (Articles 5(2) and 24). Appropriate organizational measures include making sure people know the rules. Supervisory authorities routinely ask for training records during investigations.
Security of processing (Article 32(1) and (4)). Organizational measures and steps to ensure people with access only act on instructions.
Data protection officer tasks (Article 39(1)(b)). The DPO monitors compliance, "including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits".
Binding corporate rules (Article 47(2)(n)). BCRs must include appropriate data protection training for personnel with permanent or regular access to personal data.
Processor confidentiality (Article 28(3)(b)). People authorized to process must be bound by confidentiality, which is usually combined with a briefing on what that means.

A practical program for a software company has three layers:

Everyone: what personal data is, the principles, how to spot and report a breach immediately, handling access and deletion requests, and safe use of AI tools with personal data. At onboarding and then yearly.
Customer-facing teams: support, sales and success staff who see customer data or receive rights requests.
Engineering and product: privacy by design, data minimization in schemas and logs, retention and deletion, test data, and sub-processor changes.

Keep dated training records your DPO can show an authority. In LMS Advisor you can build or upload your data protection courses, assign them by team with due dates and reminders, add a scored quiz and export completion records. Learners' own access and deletion requests go to the built-in GDPR data request queue. See compliance training in LMS Advisor and our guide to training records retention.

Map your data. List processing activities: what data, about whom, for what purpose, where it is stored, who can access it, which vendors receive it, and how long you keep it. This becomes your Article 30 record.
Decide your role for each activity. Controller, processor or joint controller.
Choose and document lawful bases. Record legitimate interest assessments where you rely on that basis.
Update privacy notices. Website, product, job applicants and employees.
Set retention periods and build deletion into the product and back office.
Put contracts in place. Your customer DPA, DPAs with your own processors, SCCs or DPF reliance for transfers, and a public sub-processor list.
Review security against Article 32. Encryption, access control, logging, backups, testing and incident response.
Write a breach procedure that meets the 72-hour clock for your controller data and your contractual notice period for customer data. Rehearse it.
Build rights handling. Intake, identity checks, deadlines, product tools for export and deletion, and a log.
Run DPIAs for high-risk features, especially new AI features, monitoring or large-scale special category data.
Appoint a DPO if Article 37 requires one, and an EU representative if Article 27 applies.
Train people and keep records. Then review the whole program yearly.

GDPR compliance checklist for SaaS and IT companies

Tick what you already have. Your progress is saved in this browser.

Records and governance

Record of processing activities as controller
Record of processing activities as processor
Lawful basis documented for each purpose
Legitimate interest assessments where used
DPO appointed, or a documented decision that one is not required
EU representative appointed if you are outside the EU and Article 27 applies

Customers and vendors

Customer DPA with all Article 28(3) terms
Public sub-processor list and change notice process
DPAs signed with your own processors
Transfer mechanism for each non-EEA transfer, with a transfer assessment

Operations

Privacy notices for website, product, applicants and staff
Retention periods set and applied
Rights request process with one-month deadline tracking
Breach procedure with a 72-hour clock, tested
DPIAs for high-risk processing
Data protection training for all staff, with dated records
Role-based training for support and engineering

Article 83 sets two tiers of administrative fines. Authorities must make each fine effective, proportionate and dissuasive, and weigh factors such as the nature, gravity and duration of the infringement, intent or negligence, steps taken to reduce harm, and cooperation.

Tier	Maximum	Examples of infringements
Article 83(4)	10 million euros or 2% of total worldwide annual turnover of the preceding year, whichever is higher	Controller and processor obligations such as Articles 25 to 39: security, records, breach notification, DPIAs, DPOs, processor contracts
Article 83(5)	20 million euros or 4% of total worldwide annual turnover of the preceding year, whichever is higher	Principles and lawful basis (Articles 5 to 9), data subject rights (12 to 22), international transfers (44 to 49), ignoring an authority's order

Authorities can also issue reprimands, order processing to stop, require deletion and suspend transfers (Article 58). Individuals can claim compensation for material or non-material damage (Article 82).

How ready is your GDPR program?

Answer yes or no for your company today.

We know which processing we do as a controller and which as a processor.
We have an up-to-date record of processing activities.
Every purpose has a documented lawful basis.
Our customer DPA covers every term in Article 28(3).
We publish a sub-processor list and notify customers of changes.
Each transfer outside the EEA has a valid mechanism and a transfer assessment.
Retention periods are set and data is actually deleted when they end.
We can answer an access or deletion request within one month.
Our breach procedure has been tested against the 72-hour deadline.
We ran DPIAs for our high-risk features.
All staff completed data protection training, and we can show the dates.
Engineering and support teams have role-based privacy training.

Exposed. Start with the data map, lawful bases and your customer DPA. These are the first things customers and authorities ask for.

Partly ready. The basics are there. Close the gaps in transfers, retention and training records next.

In good shape. Keep the records current, test the breach plan yearly and review new features with a DPIA.

Relying on consent for things that are really contract or legitimate interest, then being unable to stop when consent is withdrawn.
A DPA that lacks Article 28(3) terms, or no DPAs at all with the company's own vendors.
No retention schedule, so backups, logs and old accounts keep personal data forever.
Remote access from non-EEA support or engineering teams not treated as a transfer.
Personal data in application logs, analytics events or test environments.
Cookie banners that set trackers before consent or make refusal harder than acceptance.
Breach response that waits for full facts before notifying, missing the 72-hour window.
New AI features that send customer personal data to a model provider without updating the DPA, sub-processor list or DPIA.
No training records, so the company cannot show staff were told the rules.

UK GDPR keeps the same structure in UK law, alongside the Data Protection Act 2018 and the Data (Use and Access) Act 2025. UK and EU programs are usually run together with separate transfer rules.
ePrivacy Directive covers cookies, trackers and electronic marketing.
ISO 27701 provides a certifiable privacy management system and maps its controls to the GDPR.
ISO 27001 supports the Article 32 security duty.
EU AI Act adds duties for AI systems and applies alongside the GDPR when AI processes personal data.
NIS2 adds cybersecurity and incident reporting duties for essential and important entities.
India's DPDP Act and California's CCPA share many concepts but differ in lawful bases, rights and deadlines.

In November 2025 the European Commission proposed a Digital Omnibus package that would amend the GDPR, the ePrivacy rules on cookies and several incident reporting laws. On 21 October 2026 the Council of the EU agreed its negotiating position. Among the proposals in that position:

Breach notification to the authority only where a breach is likely to result in a high risk, with the deadline moving from 72 hours to 96 hours where feasible, and a single entry point for incident reporting.
Clarification that pseudonymized data is not personal data for a recipient that cannot identify the person.
A provision recognizing legitimate interest as a possible basis for developing and operating AI systems, assessed case by case and subject to the right to object.
Changes to cookie consent, including one-click refusal.

None of this is law yet. The European Parliament has not adopted its position, and negotiations between the institutions have not started. The current GDPR text, including the 72-hour breach deadline, still applies. We will update this guide when a final text is adopted.

Data subjectThe living person the personal data is about. ControllerThe organization that decides the purposes and means of processing. ProcessorThe organization that processes personal data on the controller's behalf. DPAData processing agreement: the contract between controller and processor required by Article 28. (Also used for "data protection authority", the supervisory authority.) DPIAData protection impact assessment, required before high-risk processing. DPOData protection officer, required in the cases in Article 37. SCCsStandard contractual clauses adopted by the Commission for international transfers. Lead supervisory authorityThe authority in the member state of a company's main EU establishment, which leads cross-border cases under the one-stop-shop.

GDPR FAQs

Does the GDPR apply to companies outside the EU?

Yes, when they offer goods or services to people in the EU or monitor their behavior there (Article 3(2)). It also applies to non-EU companies that process data as a processor for an EU customer, through their contract and the customer's own duties.

Is GDPR compliance mandatory for small companies?

Yes. The GDPR applies regardless of size. A few duties are lighter for organizations under 250 employees, such as records of processing in limited cases, but the principles, rights and security rules apply to everyone.

What is the GDPR breach notification deadline?

Controllers must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is a risk to people. Processors must notify the controller without undue delay.

What is the maximum GDPR fine?

20 million euros or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. A lower tier of 10 million euros or 2% applies to infringements such as security and record-keeping duties.

Is there a GDPR certification?

There is no general GDPR certificate. Article 42 allows approved certification schemes, but they are optional and few exist. Compliance is shown through your own records and measures.

Do we need a data protection officer?

Only in the cases in Article 37: public bodies, and organizations whose core activities involve large-scale regular and systematic monitoring of people or large-scale special category data. Others may appoint one voluntarily.

Is a SaaS company a controller or a processor?

Usually both. It is the controller for its own account, billing, marketing and staff data, and the processor for the personal data customers put into the product.

Does the GDPR require employee training?

No single article mandates annual training for everyone, but accountability, security duties, the DPO's training task in Article 39 and BCR rules in Article 47 make training an expected organizational measure. Authorities often ask for training records.

Can we transfer EU personal data to India?

Yes, with a Chapter V mechanism. India has no adequacy decision, so most companies use the European Commission's standard contractual clauses with a transfer impact assessment.

Can we still use US cloud providers under the GDPR?

Yes. Transfers to US companies certified under the EU-US Data Privacy Framework rely on the July 2023 adequacy decision. Otherwise, standard contractual clauses with a transfer assessment are used. A legal challenge to the framework is on appeal.

How long do we have to answer a data subject access request?

One month from receipt. You can extend by two further months for complex or numerous requests, if you tell the person within the first month and explain why.

Has the Digital Omnibus changed the GDPR?

Not yet. The Council agreed its position on 21 October 2026, but the European Parliament has not, and no final text exists. The current GDPR still applies.

Is LMS Advisor GDPR certified?

No. There is no general GDPR certification, and LMS Advisor holds no privacy or security certification. The LMS includes a GDPR and CCPA data request queue, data retention settings and audit logs, and helps you run and record data protection training.

Official sources and references

We checked these sources while writing and reviewing this guide. Where a rule is a proposal or a draft, the guide says so.

Regulation (EU) 2016/679 (GDPR), official text on EUR-Lex Articles cited throughout this guide
EDPB Guidelines 3/2018 on the territorial scope of the GDPR How Article 3 applies to non-EU companies
EDPB Guidelines 07/2020 on the concepts of controller and processor Role definitions
EDPB Guidelines 9/2022 on personal data breach notification Breach handling and the 72-hour rule
European Commission, standard contractual clauses for international transfers 2021 SCCs
European Commission, adequacy decisions Including the EU-US Data Privacy Framework
Irish Data Protection Commission, 1.2 billion euro fine on Meta (May 2023) Largest GDPR fine to date
Digital Omnibus procedure 2025/0360(COD), Legislative Observatory Status of the proposed amendments

Next steps

Build or refresh your record of processing activities, split by controller and processor roles.
Check your customer DPA line by line against Article 28(3).
List every non-EEA transfer, including remote support access, and confirm the mechanism.
Assign data protection training to all staff and role-based modules to support and engineering, with due dates. Book a demo to see how LMS Advisor records it.
Rehearse a breach scenario against the 72-hour clock.

GDPR compliance for IT and SaaS companies: requirements and checklist