GDPR Compliance Checklist for SaaS Companies

Last updated: 2026-06-09 — ComplianceStack Editorial Team

17 items
🎯

Generate Your Personalized GDPR Checklist

Tell us about your organization and we'll tailor this 17-item checklist to your situation — highlighting your gaps, marking what you already have, and calculating your readiness score. Free. Instant. Downloadable.

SaaS GDPR Compliance Checklist

0 of 17 items reviewed

1

Establish Data Processing Agreements (DPAs)

Critical 5 days

Execute written DPAs with all customers acting as controllers, specifying processing purposes, data types, duration, obligations, and security measures. DPAs must meet Article 28 requirements and be in place before processing begins.

GDPR Article 28(3)
2

Implement Sub-Processor Management

Critical 3 days

Maintain a current list of all sub-processors, obtain customer consent (general or specific authorization), and ensure sub-processors are bound by equivalent GDPR obligations through written contracts.

GDPR Article 28(2), Article 28(4)
3

Execute Standard Contractual Clauses (SCCs)

Critical 4 days

Implement EU Commission-approved SCCs for any transfers of personal data outside the EEA, using the appropriate module (controller-to-processor, processor-to-processor, etc.) adopted in June 2021.

GDPR Article 46(2)(c), Article 28(3)(a)
4

Conduct Transfer Impact Assessments (TIAs)

High 6 days

Perform and document TIAs for international data transfers to assess if destination country laws impair SCC protections, considering government access laws and supplementary measures needed.

GDPR Article 46, Schrems II (C-311/18)
5

Implement Privacy by Design and Default

High 15 days

Integrate data protection into system architecture from the outset, implementing technical measures like pseudonymization, encryption, and data minimization by default in all product features.

GDPR Article 25
6

Conduct Data Protection Impact Assessments (DPIAs)

High 8 days

Perform DPIAs before processing operations likely to result in high risk to individuals' rights, including large-scale processing, automated decision-making, or systematic monitoring. Document findings and mitigation measures.

GDPR Article 35
7

Establish Breach Notification Procedures

Critical 4 days

Implement processes to detect, investigate, and report personal data breaches to supervisory authorities within 72 hours and to affected individuals without undue delay when high risk exists.

GDPR Article 33, Article 34
8

Identify Lawful Basis for Processing

Critical 3 days

Document the lawful basis (consent, contract, legitimate interest, legal obligation, vital interest, or public task) for each processing activity and ensure processing aligns with stated purposes.

GDPR Article 6
9

Maintain Records of Processing Activities

High 5 days

Create and maintain comprehensive records documenting processing purposes, data categories, recipients, retention periods, security measures, and international transfers for all processing activities.

GDPR Article 30
10

Determine DPO Requirements and Appoint if Needed

High 2 days

Assess whether your processing activities require a Data Protection Officer (large-scale monitoring or special category data processing) and appoint a qualified DPO with appropriate resources and independence.

GDPR Article 37, Article 38, Article 39
11

Implement Data Subject Access Rights (DSAR) Process

High 6 days

Establish procedures to respond to data subject access requests within one month, providing copies of personal data, processing information, and verification of requester identity.

GDPR Article 15
12

Enable Right to Rectification and Erasure

Medium 8 days

Build functionality and processes allowing individuals to correct inaccurate data and request deletion (right to be forgotten) when processing is no longer necessary or consent is withdrawn.

GDPR Article 16, Article 17
13

Implement Data Portability Features

Medium 10 days

Provide mechanisms for data subjects to receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.

GDPR Article 20
14

Apply Data Minimization Principles

Medium 4 days

Collect and process only personal data that is adequate, relevant, and limited to what is necessary for specified purposes. Regularly review data collection practices and remove unnecessary fields.

GDPR Article 5(1)(c)
15

Establish Data Retention Policies

High 5 days

Define and document retention periods for each data category based on legal requirements and business necessity. Implement automated deletion processes to ensure data is not kept longer than needed.

GDPR Article 5(1)(e), Article 17
16

Implement Technical Security Measures

Critical 12 days

Deploy appropriate technical safeguards including encryption at rest and in transit, access controls, pseudonymization, regular security testing, and incident response capabilities to ensure data security.

GDPR Article 32
17

Establish Consent Management System

High 7 days

Where consent is the lawful basis, implement systems to obtain, record, and manage freely given, specific, informed, and unambiguous consent with easy withdrawal mechanisms.

GDPR Article 7, Article 4(11)

Common Mistakes to Avoid

Processing customer data without valid Data Processing Agreements in place before service activation
Violates Article 28 processor obligations and creates liability for both parties. British Airways was fined £20 million in 2020 partly due to inadequate processor agreements and security measures.
Using sub-processors without customer notification or authorization and without flowing down GDPR obligations
Creates joint liability under Article 28(4) and can result in fines up to €20 million or 4% of turnover. Controllers may terminate agreements and seek damages for unauthorized sub-processing.
Transferring data to US or other third countries using only SCCs without conducting Transfer Impact Assessments post-Schrems II
Violates Article 46 requirements as clarified by CJEU in Schrems II. Austrian DPA issued decisions in 2021-2022 requiring cessation of transfers to US providers lacking adequate supplementary measures.
Failing to notify supervisory authorities of personal data breaches within the 72-hour deadline
Violates Article 33 and typically results in additional fines beyond those for the underlying security failure. H&M received €35 million fine in 2020 that included breach notification failures.
Building features that default to maximum data collection and sharing instead of privacy by default
Violates Article 25 privacy by design and default. Google was fined €50 million by French DPA in 2019 partly for unclear default privacy settings during account creation.

Frequently Asked Questions

What is the maximum fine for GDPR non-compliance for SaaS companies?

GDPR Article 83 establishes a two-tier fine structure. The highest tier applies to violations of core principles (Articles 5, 6, 7, 9), data subject rights (Articles 12-22), and international transfer requirements (Articles 44-49), with fines up to €20 million or 4% of global annual turnover, whichever is higher. Lower-tier violations carry fines up to €10 million or 2% of global turnover. The highest GDPR fine to date was €746 million against Amazon in 2021 for consent and data processing violations.

Do we need Standard Contractual Clauses if our SaaS infrastructure is entirely within the EU?

Not for intra-EU transfers, but you likely still need SCCs. Most SaaS companies use sub-processors (analytics, payment processors, customer support tools) located outside the EEA, requiring SCCs under Article 46(2)(c). Even if primary infrastructure is EU-based, remote employee access from non-EEA countries or parent company access constitutes international transfers requiring transfer mechanisms. Following the Schrems II decision (C-311/18), SCCs alone are insufficient — you must also conduct Transfer Impact Assessments and implement supplementary measures where destination country laws may impair SCC protections.

As a SaaS processor, are we liable for GDPR violations if our customer-controller instructs us to process data unlawfully?

Yes, processors have independent liability under GDPR Article 82(2). While you must generally follow customer instructions per Article 28(3)(a), Article 28(10) explicitly states processors are liable if they process data outside instructions, fail to meet GDPR obligations, or act outside lawful instructions. If a customer instructs unlawful processing, Article 28(3)(h) requires you to immediately inform the customer. Processors can be fined directly under Article 83(4)(a) for violations including inadequate security (Article 32), unauthorized sub-processing (Article 28(2)), or failing to assist with DPIAs and breach notifications.

Get This Checklist Emailed to You

No account needed. We'll email you the full checklist + any updates to compliance requirements.

Related Checklists