RCM
Privacy by design
CHECKLIST · SAAS AND STARTUPSSaaS GDPR checklist.
SaaS GDPR checklist.
Prepare the product and the deal.
European customers expect more than a privacy notice. They want to understand roles, personal data, hosting, access, vendors, international transfers and the controls protecting their environment.
SaaS GDPR readiness connects product architecture with contractual and operational evidence: data mapping, controller and processor roles, DPA terms, security, transfers, rights, retention, incidents and a review process for new product changes.
DPA and questionnaires
Downloadable checklist
Architecture and roles
Data flows
Map collection, imports, support, logs, backups, analytics, AI and deletion.
Roles
Identify when the provider acts as processor, controller or joint controller for each purpose.
Environments
Separate production, testing, demonstration and support, and minimise real personal data outside production.
Contracts and vendors
DPA
Prepare Article 28 terms covering instructions, assistance, audit, security and end-of-service handling.
Subprocessors
Maintain an accurate list, notification mechanism and applicable objection process.
Customer questionnaires
Keep approved answers consistent with architecture, contracts and actual operating practices.
Transfers, security and operations
Locations
Document hosting, support and administrator-access countries.
Controls
Describe access, encryption, logging, backups, isolation, vulnerability management and continuity without overclaiming.
Operations
Organise rights requests, incidents, retention, deletion and evidence of decisions.
IMPLEMENTATION GUIDE
Move from checklist to a documented decision
Connect product architecture to privacy documentation
Start with a flow diagram following data from collection to deletion across APIs, imports, support, logs, backups, analytics, AI features and subprocessors. For each stage, record the purpose, role, location, access and retention. This becomes the common factual base for the record of processing, DPA, privacy notice and customer questionnaire answers.
Documentation should follow product versions. A new integration, hosting change or analytics feature can alter roles, purposes and transfers. Add a privacy review to design and release workflows so contracts and sales evidence do not describe an outdated architecture.
Prepare the trust package sales teams actually need
European prospects commonly request a DPA, subprocessor list, hosting and support locations, security measures, retention periods and the incident process. Maintain approved answers and an owner for each artefact. Sales language must remain consistent with contracts and with the controls actually operating in production.
Avoid claims such as fully compliant or EU-only unless they can be demonstrated. A certification may support an answer but does not replace assessment of the service. Where information is confidential, prepare a public control summary and a more detailed evidence tier available under appropriate confidentiality terms.
Operate the commitments after signature
Compliance does not end when the questionnaire is accepted. Rights requests, end-of-contract deletion, subprocessor notices, access reviews and incident support must work in practice. Response times, channels and the division of responsibility between customer and provider should be tested rather than merely copied into the DPA.
A lightweight dashboard can track new vendors, location changes, requests, incidents, deletion deadlines and security actions. For AI-enabled features, this guide addresses personal-data governance only; it is not a general AI Act compliance assessment or an audit of model performance.
PDF · PRACTICAL RESOURCE
Get the PDF version
Receive the PDF version for product, security and sales teams.
FAQ
Frequently asked questions
Is a SaaS provider always a processor?+
No. The role depends on who determines the purpose and essential means for each processing activity.
Does every customer need a DPA?+
Where the SaaS processes personal data on the customer’s behalf, Article 28 terms are generally required.
Does GDPR apply to test data?+
Yes if a person remains identifiable. Anonymous or synthetic data should be preferred.
Does US hosting make a service prohibited?+
Not automatically. The transfer, applicable mechanism and supplementary measures must be assessed.
When does a SaaS need a DPIA?+
A DPIA is required where the processing is likely to result in a high risk to individuals.
This guide provides a general framework and does not replace an assessment of your circumstances or reserved legal advice.
RCM
Explore SaaS GDPR support →Prepare your SaaS for European customers
Build the evidence before the next vendor questionnaire arrives.