General Data Protection Regulation (GDPR)
The GDPR governs how organizations collect, use, store, and transfer personal data of people in the EU.
Who Needs It
GDPR reaches well beyond Europe. You're in scope if you:
- Have an establishment in the EU or European Economic Area (EEA), or
- Offer goods or services to people in the EU (paid or free), or
- Monitor the behavior of people in the EU, which includes routine analytics and ad tracking
Your role determines your obligations. Controllers decide why and how personal data is processed; processors handle data on a controller's behalf. A SaaS company typically wears both hats: controller for its own customer and marketing data, processor for whatever its customers store in the product. Processors need Article 28 data processing agreements with their controllers; expect every EU customer to put one in front of you.
And "personal data" is broad: names, emails, IP addresses, device identifiers, location data. Business contact details count too; there is no B2B exemption.
How the Regulation Is Structured
GDPR runs to 99 articles, but the working core is three lists worth internalizing.
Six processing principles (Article 5): lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; and integrity and confidentiality. A seventh, accountability, requires you to be able to demonstrate compliance with the other six, which is why documentation matters so much.
Six lawful bases (Article 6). Every processing activity needs exactly one: consent, contract, legal obligation, vital interests, public task, or legitimate interests. A common early mistake is treating consent as the default; it's the hardest basis to maintain, since it must be freely given, specific, and as easy to withdraw as to give. Most routine B2B processing rests on contract or legitimate interests instead.
Eight data subject rights (Articles 15-22): access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, protection from solely automated decision-making, plus the right to withdraw consent at any time. You have one month to respond to a request, extendable by two more for complex cases, and you need the technical ability to actually find and act on one person's data across your systems.
Special category data (health, biometrics, racial or ethnic origin, political opinions, sexual orientation, and similar) requires an additional Article 9 condition on top of a lawful basis.
Key Obligations
Beyond the principles and rights, five requirements drive most GDPR programs:
| Obligation | Article | What It Requires |
|---|---|---|
| Records of processing | 30 | A maintained inventory of what you process, why, and where it flows |
| Breach notification | 33-34 | 72 hours to your supervisory authority; affected individuals without undue delay when the risk is high |
| Data Protection Impact Assessments | 35 | Assessment before high-risk processing such as large-scale monitoring or special category data |
| Data Protection Officer (DPO) | 37 | Mandatory for public authorities and for organizations whose core activities involve large-scale systematic monitoring or large-scale special category processing |
| International transfers | Chapter V | Data leaving the EU needs an adequacy decision, standard contractual clauses, or another Chapter V mechanism |
Where to Start
There is no external audit to schedule; GDPR follows a self-assessment model, and a supervisory authority can ask you to demonstrate compliance at any time. For an organization starting from zero, the early work is mostly mapping and documentation, and sequence matters:
- Inventory your personal data. Map what you process and where it lives for each population separately: customers, prospects, website visitors, employees, and job applicants. Each has its own purposes, lawful bases, and data flows.
- Involve legal counsel early. GDPR is a law, not a technical standard. Your privacy notice, DPAs, and lawful basis decisions should get legal review; template documents alone do not establish compliance. We also recommend periodic internal gap assessments covering data flows and privacy risks, validated by a privacy attorney or qualified consultant where the stakes warrant it.
- Settle the role questions. Determine whether you need a DPO under Article 37, and, if you have no EU establishment but are still in scope, whether you need to appoint an EU representative under Article 27.
- Publish or update your privacy notice covering website visitors and prospects as well as product users, and have legal review it against the regulation. If your site sets non-essential cookies, cookie consent is part of this step.
- Put DPAs in place in both directions: with your customers, where you act as their processor, and with every subprocessor your product sends personal data to.
- Build your records of processing. Two ROPAs cover most SaaS companies: one for the product and its subprocessor data flows (noting any special category data), and one for marketing and sales operations such as CRM usage and deletion practices.
- Stand up a data subject access request (DSAR) intake channel before the first request arrives, such as a monitored privacy@ inbox or a web form, with a documented process that meets the one-month response deadline.
For the artifacts that typically satisfy manually evidenced control areas, see Example Evidence.
FAQ
Is there a GDPR certification?
No universally recognized one. Article 42 allows for certification schemes and a few national ones exist, but none is a compliance safe harbor. ISO 27701 (privacy extension to ISO 27001) is the closest widely recognized way to demonstrate a privacy management system.
Do we need a DPO?
Only if you hit an Article 37 trigger: public authority, large-scale systematic monitoring, or large-scale special category processing. Many companies appoint a privacy lead anyway; just don't title them "DPO" casually, because the role carries statutory independence requirements.
We're a US company with a few EU users. Does GDPR really apply?
If you're deliberately offering services to people in the EU or monitoring their behavior, yes. Enforcement against small foreign companies is rare, but your EU customers' procurement teams will hold you to it contractually regardless.
Does GDPR require data to stay in the EU?
No, it requires transfers out of the EU to be covered by a valid mechanism, most commonly standard contractual clauses or an adequacy decision (the EU-US Data Privacy Framework covers certified US companies).