GDPR for SaaS Founders: What You Actually Need to Do

GDPR compliance has a reputation for being overwhelming — a mountain of legal text that only matters if you're a large enterprise. That reputation is wrong, and dangerous. If your SaaS product serves any users in the EU or EEA, GDPR applies to you regardless of your company size. The fines for non-compliance can reach €20 million or 4% of global annual turnover, whichever is higher.

But here's the reassuring truth: the practical requirements for a typical B2B SaaS product are manageable. You don't need a legal team or an expensive DPO. You need to understand the principles, implement them systematically, and document what you've done.

The Six Legal Bases for Processing

Every piece of personal data you process needs a legal basis. For most SaaS products, you'll rely on three:

• Contract performance — processing data because it's necessary to deliver your service
• Legitimate interests — analytics, fraud prevention, and product improvement (must be balanced against user rights)
• Consent — marketing emails, analytics cookies, and anything beyond what's strictly necessary

The Practical Checklist

• Write a plain-English Privacy Policy that explains what you collect, why, and for how long
• Implement a cookie consent banner with granular controls (Essential, Analytics, Marketing)
• Add consent checkboxes to all forms collecting personal data
• Build a data deletion mechanism — users must be able to request erasure
• Define your data retention periods and actually enforce them
• Assess any third-party processors (Stripe, SendGrid, Google Analytics) and ensure they have DPAs
• If you process data on behalf of enterprise clients, execute a Data Processing Agreement
• Have a breach notification procedure — you have 72 hours to notify your supervisory authority

The One Thing Most Founders Skip

Most founders implement the visible compliance theatre — privacy policy, cookie banner — and skip the operational discipline. GDPR isn't primarily about what your website says. It's about what you actually do with data. Do you actually delete user data when they request it? Are your data retention periods enforced automatically or by someone remembering to run a manual process? Is your analytics actually gated behind consent or just theoretically gated?

“The regulators who actually issue fines care about process failures and evidence of systematic neglect — not whether your privacy policy font is the right size.”

— Zahid Hassan

Where to Start Today

If you're starting from zero, prioritise in this order: (1) Privacy Policy, (2) cookie consent that actually controls your analytics loading, (3) data deletion capability, (4) consent on data-collecting forms. That covers the most commonly cited enforcement actions and gets you to a defensible position quickly.