GDPR compliance checklist for SaaS founders

We collect only the personal data we need for the feature in question

GDPR Article 5(1)(c), data minimization. If you can deliver the feature without an email address, don't collect the email address.

Every category of personal data we collect has a documented lawful basis

Article 6. Most SaaS bases are Consent or Legitimate Interest. Write down which applies to each data category and where.

Consent is granular, opt-in (not pre-checked), and revocable

Article 7. Pre-checked boxes are not consent. Bundled consent is not consent.

Cross-border transfers use a valid mechanism (e.g. SCCs)

Article 44. Standard Contractual Clauses (with supplementary measures post-Schrems II) are the most common safeguard.

No third-country processor without a DPA + SCCs (or DPF for US)

Article 46. If your AI provider, error tracker, or analytics is in a non-adequate country, sign the right paperwork.

We publish a full subprocessor list with locations

Article 28. Users have the right to know who you share their data with.

We have a Data Processing Agreement ready to send to enterprise customers

Article 28(3). Templates available from any privacy lawyer; sign one before your first paid B2B customer asks.

Users can export their data (right to access)

Article 15. Doesn't have to be one-click; has to be possible within 30 days.

Users can correct their data

Article 16. Usually trivial: settings page edits.

Users can delete their data (right to be forgotten)

Article 17. Hard part: backups. Have a documented process for purging from backups too.

Data export is in a machine-readable format

Article 20. JSON or CSV is enough. Hand-written PDF is not.

Users can object to specific processing

Article 21. Most relevant for marketing emails: easy unsubscribe required.

We have a 72-hour breach notification plan

Article 33. Doesn't need to be elaborate. Needs to exist before you need it.

We've checked whether we need a Data Protection Officer

Article 37. Required for systematic monitoring at scale or special categories of data. Most early-stage SaaS doesn't need one.

We maintain a Record of Processing Activities (RoPA)

Article 30. Required if you're 250+ employees OR your processing is risky. Write it down anyway; it's a useful internal document.

New features go through a Privacy-by-Design review

Article 25. In practice: a PR template that asks 'what personal data does this feature touch?'

Our terms forbid users under 18 (or whatever the local age of consent is)

Article 8. Or you've built proper parental consent flows. Either way, document it.

Cookies require consent before non-essential cookies fire

ePrivacy Directive + GDPR. Tracking cookies before consent = a fine vector.

Our ToS clearly states what data we collect and why

Article 13. Avoid the wall-of-text. Use plain language.

We have a written 'we don't train on user data' policy

Not directly required by GDPR but increasingly expected. Both for your own use of AI and for your AI vendors.

Data is encrypted at rest

Article 32. Most managed databases default to AES-256. Confirm yours does.

Data is encrypted in transit (TLS 1.2+)

Article 32. TLS 1.3 preferred. SSL Labs A or A+ grade.

Sensitive actions are logged in an audit trail

Article 32 + accountability principle. Who accessed what, when.

We've reviewed our vendor list for GDPR compliance

Each subprocessor: where do they host? Do they have a DPA? Have you signed it?

We re-review this checklist at least once a year

Compliance is not a one-time activity. Calendar it.