SaaS GDPR Compliance Checklist — Complete Guide for Non-EU Companies
Complete GDPR compliance checklist for SaaS companies outside the EU. Article 27 EU Representative, ROPA, DPA, cookie consent, and more.
SaaS companies face some of the strictest GDPR obligations because data processing is the core business activity. If your SaaS platform has EU users, this checklist covers everything you need.
Required Actions for Every SaaS
EU Representative (Article 27)
Required for all non-EU SaaS companies with EU users. Cost: EUR 490/year through EU Shield. Setup in 15 minutes.
Data Processing Records (Article 30)
Maintain a Record of Processing Activities documenting: what data you collect, why, where it’s stored, who has access, retention periods, transfer mechanisms. Use our ROPA template.
Privacy Policy
Must include: controller identity, EU Representative contact, processing purposes, legal bases, data retention periods, data subject rights, cross-border transfer mechanisms. Template here.
Data Processing Agreements (DPA)
If you use EU-based infrastructure (AWS EU, DigitalOcean EU, Hetzner), you need a DPA. Also required if your SaaS sub-processes EU data. DPA template →
Cookie Consent
If your SaaS website uses tracking cookies (analytics, marketing, session recording), implement a compliant Consent Management Platform. CMP comparison →
SaaS-Specific Issues
User Content Data
Your SaaS may host EU user content (files, messages, documents). This is your users’ personal data, and you are the data processor. You need a DPA with your SaaS customers and an EU Representative.
Billing Data
Stripe, Paddle, Chargebee — all process EU personal data on your behalf. Ensure your payment processors have DPAs in place and EU Representative compliance.
Analytics
Google Analytics, Amplitude, Mixpanel — these collect EU user data. Use GDPR-compliant configurations (IP anonymisation, data retention limits, consent mode).
Step-by-Step SaaS Compliance
- Appoint EU Shield as your EU Representative
- Audit data processing — what data flows through your SaaS?
- Create your ROPA — document every processing activity
- Update Privacy Policy — include EU Representative and processing details
- Implement cookie consent — deploy a CMP
- Sign DPAs — with infrastructure providers and payment processors
Ready to get compliant?
€490/year. 15-minute setup. Active next business day.