The GDPR applies to companies outside the EU when they offer goods or services to people in the EU or monitor their behaviour. For many US SaaS companies, the first sign is a European customer’s procurement team sending a data processing agreement and a list of questions.
A starter checklist
- Map your data: what personal data you collect, why, where it is stored and who receives it.
- Know your role: for customer data you are usually a processor; for your own marketing and users you are a controller.
- Keep records of processing (Article 30) for both roles.
- Pick a lawful basis for each controller activity and document it.
- Prepare a data processing agreement that meets Article 28, plus a current list of your subprocessors.
- Cover international transfers: standard contractual clauses, or certification under the EU-U.S. Data Privacy Framework where appropriate, and keep an eye on legal developments.
- Consider an EU representative (Article 27) if you have no establishment in the EU.
- Update your privacy notice so it is accurate, specific and easy to read.
- Handle data-subject requests (access, deletion, correction) within one month.
- Be ready for breaches: controllers must notify the supervisory authority within 72 hours of becoming aware of a qualifying breach.
Do not forget US state laws
California’s CCPA/CPRA and a growing number of other state privacy laws overlap with the GDPR but differ in scope, thresholds and terminology. One data map and one set of well-designed processes can serve all of them.
Need a second opinion on your situation? Book a free 30-minute consultation.