The General Data Protection Regulation governs how any company processes personal data of people in the EU/UK.
The General Data Protection Regulation (GDPR) is the EU privacy law that took effect in 2018, replacing a patchwork of national laws with unified rules for how companies process personal data of EU/UK residents. GDPR applies regardless of your company's location — if you have EU users, you must comply. Penalties reach 4% of global revenue for serious violations, and enforcement has become more aggressive over time. Compliance is a mix of paperwork (DPAs, privacy notices, records of processing), engineering (data subject rights, retention, security controls), and operations (breach notification, DPO if required).
Personal data — any information relating to an identifiable person, defined broadly (email, IP, device ID, behavioral patterns). Controller vs. processor — the controller decides why and how data is processed (your company); processors act on the controller's instructions (your vendors). Legal basis — every processing purpose needs one of six bases (consent, contract, legal obligation, vital interests, public interest, legitimate interest); the default 'consent' is often the wrong choice for B2B SaaS where 'contract' or 'legitimate interest' fits better. Special category data (health, biometric, ethnicity) has stricter rules and mostly requires explicit consent.
(1) Privacy notice — public-facing, explains what data you collect, why, legal basis, retention, rights. Update when you change processing. (2) Data Processing Agreement (DPA) — signed with every processor (vendor). Standard templates exist; most vendors have their own. (3) Records of Processing Activities (Article 30) — internal register of every processing purpose with categories of data, recipients, and retention. Required if you have 250+ employees or high-risk processing. (4) DPIA (Data Protection Impact Assessment) — required for high-risk processing (large-scale profiling, biometric, systematic monitoring). Skip only if none of your processing is high-risk.
EU users have the right to: access their data, correct it, delete it (right to be forgotten), export it (data portability), object to processing, restrict processing, and not be subject to solely automated decisions. Requests must be handled within one month. Build an internal process — a form or email address (privacy@) monitored, an SLA'd handoff to engineering, and reproducible steps for each right. Manual scramble on the first request doesn't scale and blows the deadline. Deletion needs to cascade through backups, warehouses, and third-party processors; document the actual coverage rather than claiming full deletion.
Transferring EU personal data outside the EU requires safeguards. Since Schrems II (2020), transfers to the US require Standard Contractual Clauses (SCCs) plus transfer impact assessments. The EU-US Data Privacy Framework (2023) simplifies this for participating US companies. Most cloud vendors (AWS, GCP, Azure, Cloudflare) support EU-region hosting; using EU regions for EU customer data is often the simplest path. Sub-processor lists must be public and customers must be able to object to new sub-processors.
Personal data breaches must be reported to your lead supervisory authority within 72 hours if the breach is likely to result in risk to individuals. If the risk is high, affected individuals must also be notified. 'Breach' includes loss of confidentiality (leaked data) and loss of availability (lost/unrecoverable data). Have an incident response playbook that includes the privacy team, legal counsel, and pre-drafted notification templates. Missing the 72-hour deadline is one of the more penalized GDPR violations.
Investor directory · Fundraising library · Articles A–Z · Company funding database