The Definitive GDPR Compliance Guide for Non-EU SaaS (2026)

Everything a SaaS company outside the EU actually has to do to be GDPR compliant — the trigger tests, the obligations, the evidence buyers ask for, and the shortcut of collecting it once and reusing it everywhere.

Most GDPR content is written for European companies, or it drowns you in legalese and leaves you no closer to knowing what to build. This guide is different. It’s written for the SaaS company headquartered in Toronto, Austin, Bangalore, or São Paulo that has EU users and needs to know, concretely, what the General Data Protection Regulation requires and how to prove it.

We’ll answer the first question everyone gets wrong — does GDPR even apply to us? — then walk every obligation as an engineering-and-governance task, not a lecture. If you already juggle multiple regimes, pair this with our Cross-Border Compliance Playbook.

Does GDPR Even Apply to You? (Yes, Probably)

Here’s the myth that gets non-EU companies in trouble: “We’re not in Europe, so GDPR isn’t our problem.” Wrong. GDPR has extraterritorial reach written directly into Article 3. Your servers can sit in Ohio and your head office in Vancouver — if you touch EU residents’ data in the ways below, you’re in scope.

Article 3(2) — the two triggers. GDPR applies to an organization with no EU establishment if it does either of these with respect to people in the EU:

1. Offers goods or services to individuals in the EU (paid or free — a free tier counts). Signals include pricing in euros, an EU language option, or shipping/serving EU countries.

2. Monitors the behavior of individuals in the EU — analytics, cookies, tracking pixels, behavioral profiling, or usage telemetry on EU visitors.

The accidental-scope trap. You don’t have to target Europe to fall in scope. A product-led SaaS with self-serve signup will collect EU users whether you marketed there or not, and behavioral analytics on your marketing site can trigger Article 3(2) on its own. If EU personal data flows through your systems, assume GDPR applies and build accordingly — it is far cheaper than discovering otherwise during a deal review.

The Seven Principles Everything Hangs On

Every specific obligation traces back to seven principles in Article 5. Internalize these and most GDPR decisions answer themselves.

Lawfulness, fairness & transparency

Have a valid legal basis, and tell people plainly what you do with their data.

Purpose limitation

Collect data for a specific stated purpose — don’t quietly repurpose it later.

Data minimization

Collect only what you actually need. “Nice to have” is not a legal basis.

Accuracy

Keep personal data correct and current; let people fix it.

Storage limitation

Don’t keep data forever. Set and enforce retention periods.

Integrity & confidentiality

Secure the data — encryption, access control, the works.

The seventh, accountability, is the one that turns GDPR from a philosophy into a workload: you must be able to demonstrate compliance with all of the above. In practice, “compliant” and “can prove it on demand” are the same thing.

Your GDPR Obligations as a Non-EU SaaS

This is the working list. Each item is something you set up once and then keep evidenced.

1. Appoint an EU Representative Article 27

If GDPR applies to you under Article 3(2) and you have no establishment in the EU, you must designate a representative in an EU member state — a named contact that regulators and data subjects can reach. It’s a mandatory, often-skipped step for non-EU companies. A handful of narrow exemptions exist (occasional, low-risk processing), but most SaaS products don’t qualify. The UK’s separate regime means you may also need a UK representative if you serve UK users.

2. Establish a lawful basis (and get consent right)

Every processing activity needs one of six lawful bases — most commonly consent, contract, or legitimate interests. Consent under GDPR is a high bar: freely given, specific, informed, and as easy to withdraw as to give. Pre-ticked boxes and cookie walls don’t cut it. Map each thing you do with data to its basis, and write it down.

3. Keep Records of Processing Activities Article 30

You need an internal inventory of what personal data you process, why, who you share it with, where it goes, and how long you keep it. The RoPA is the backbone document every other obligation leans on — and the first thing a serious auditor or DPA asks to see.

4. Sign Data Processing Agreements with sub-processors Article 28

You’re a processor for your customers, and your own vendors (cloud host, analytics, email, support tooling) are your sub-processors. Article 28 requires a DPA with each one, flowing down the same obligations. A gap in a sub-processor’s terms becomes your liability.

5. Handle international data transfers

Moving EU personal data outside the EEA — which nearly every non-EU SaaS does by definition — needs a valid transfer mechanism: an adequacy decision for the destination country, or Standard Contractual Clauses backed by a transfer impact assessment. Get the mechanism in place before the data flows, not after.

6. Appoint a Data Protection Officer — if you cross the threshold

A DPO is mandatory if your core activities involve large-scale systematic monitoring or large-scale processing of special-category data. Many SaaS companies don’t strictly need one, but appointing a responsible privacy owner is good practice regardless — someone has to own this.

7. Be ready for data-subject rights (DSARs)

EU residents can ask to access, correct, delete, port, or restrict their data, and you generally have one month to respond. If your architecture can’t locate and export one user’s data quickly, that’s a gap to fix now — DSAR volume only goes up.

8. Report breaches within 72 hours

A personal-data breach that risks people’s rights must be reported to the relevant supervisory authority within 72 hours of you becoming aware of it, and to affected individuals when the risk is high. Seventy-two hours is not a lot of time to detect, assess, and document — which is why the detection and logging has to exist before anything goes wrong.

Requirement → Control → Evidence

The move that separates “we wrote a policy” from “we passed the review” is treating each requirement as a control you can produce evidence for.

GDPR requirement	What you build	Evidence you keep
Lawful basis & consent	Consent capture + preference center	Consent logs with timestamp & scope
Records of processing (Art 30)	Data inventory / RoPA	Current, dated RoPA export
Sub-processor DPAs (Art 28)	Vendor management process	Signed DPAs + sub-processor list
International transfers	SCCs + transfer impact assessments	Executed SCCs, TIA documents
Security (Art 32)	Encryption, access control, logging	Config exports, access reviews, log samples
Data-subject rights	DSAR workflow + data-export tooling	DSAR tickets with response times
Breach notification	Incident-response plan + monitoring	Incident tickets, notification records

Security in Practice Article 32

Article 32 requires “appropriate technical and organisational measures.” Vague on paper, concrete in a vendor review. Here’s the control design on the left and the evidence you’ll be asked for on the right.

🛠 One Control Design

Encryption at rest & in transit (TLS 1.2+)
SSO + MFA, least-privilege access
Centralized audit logging
Tested incident-response plan
Backups + restore testing

📂 Evidence You Collect

Encryption configuration exports
MFA enforcement + access-review records
Log-retention config & sample logs
Incident tickets + tabletop notes
Backup & restore-test results

The Non-EU SaaS GDPR Readiness Checklist

Bookmark this. If you can tick every box with an artifact behind it, you can walk into an EU procurement review with confidence.

Confirmed whether Article 3(2) applies (offering services / monitoring behavior)
EU representative appointed under Article 27 (and UK rep if needed)
A lawful basis mapped to every processing activity
Compliant consent capture with easy withdrawal
A current, dated Record of Processing Activities
Signed DPAs with every sub-processor + a public sub-processor list
SCCs and transfer impact assessments for data leaving the EEA
A working DSAR process that meets the one-month deadline
Security measures per Article 32, with evidence
A 72-hour breach notification playbook that’s been rehearsed
An updated privacy notice that reflects reality

What Non-Compliance Actually Costs

Two tiers of fines. Lower-tier breaches (e.g. RoPA or Article 28 failures) can reach €10 million or 2% of global annual turnover, whichever is higher. Serious breaches (violating the core principles or data-subject rights) can reach €20 million or 4% of global annual turnover. But for most SaaS companies, the sharper daily cost isn’t the fine — it’s the deal you don’t close because you couldn’t answer the buyer’s data-protection questionnaire.

Collect It Once, Use It Everywhere

Here’s the leverage, and it’s the whole reason to build GDPR as a program rather than a scramble. The controls GDPR asks for are nearly identical to what SOC 2 and ISO 27001 auditors want — and to what Quebec’s Loi 25 requires. Map each control once and the same artifact satisfies several frameworks at once.

GDPR control	Also satisfies
Access control + MFA	SOC 2 CC6.x · ISO 27001 A.5/A.8 · Loi 25
Audit logging & review	SOC 2 CC7.x · ISO 27001 A.8.15
Encryption at rest / in transit	SOC 2 CC6.7 · ISO 27001 A.8.24 · Loi 25 safeguards
Records of processing / data inventory	ISO 27001 A.5.9 · Loi 25 · CCPA data mapping
Vendor / DPA management	SOC 2 CC9.2 · ISO 27001 A.5.19–.22
Incident response (72-hour)	SOC 2 CC7.3/7.4 · ISO 27001 A.5.24–.27 · Loi 25

The compounding payoff. Build the control library once and every subsequent framework — GDPR today, SOC 2 for your next enterprise deal, ISO 27001 for the one after — reuses the same evidence instead of starting from zero. That’s the difference between compliance as a tax and compliance as a moat. See how it maps across regimes in the Cross-Border Compliance Playbook.

Stop Guessing. Start Proving.

A compliance automation platform maps every GDPR requirement to a control, collects the evidence continuously, and reuses it across SOC 2 and ISO 27001 — so an EU customer’s data-protection review becomes a link you send, not a fire drill you survive.

Prove it once. Prove it always.

Explore GDPR Compliance with Mindsec

Frequently Asked Questions

Does GDPR apply to a company with no office in the EU?▸

Yes, if the company offers goods or services to people in the EU or monitors their behavior. GDPR’s Article 3(2) gives the regulation extraterritorial reach, so a SaaS company based anywhere in the world can be fully subject to GDPR based on who its users are — not where its servers or headquarters are located. A free tier, euro pricing, an EU language option, or analytics on EU visitors can each bring you into scope.

What is a GDPR Article 27 representative, and do we need one?▸

An Article 27 representative is a person or company established in an EU member state that acts as your local point of contact for supervisory authorities and data subjects. If GDPR applies to your non-EU organization under Article 3(2) and you have no EU establishment, appointing a representative is mandatory, apart from a few narrow low-risk exemptions that most SaaS products don’t meet. If you also serve UK users, you may need a separate UK representative.

How do non-EU SaaS companies handle international data transfers under GDPR?▸

Transferring EU personal data outside the EEA requires a valid transfer mechanism. If the destination country has an EU adequacy decision, transfers can proceed on that basis. Otherwise, you generally rely on Standard Contractual Clauses supported by a transfer impact assessment that checks whether local laws undermine the protections. The mechanism must be in place before data is transferred, and it should be documented as part of your records.

What are the GDPR fines for non-compliance?▸

GDPR has two fine tiers. Less severe infringements, such as failures around records of processing or processor contracts, can reach €10 million or 2% of global annual turnover, whichever is higher. More serious infringements, such as violating the core data-protection principles or data-subject rights, can reach €20 million or 4% of global annual turnover. Enforcement is handled by EU member-state supervisory authorities.

Can GDPR evidence be reused for SOC 2 and ISO 27001?▸

Yes. GDPR’s security and governance requirements overlap heavily with SOC 2 Trust Services Criteria and ISO 27001 Annex A controls — access control, encryption, logging, vendor management, and incident response appear in all of them. Mapping each control once and collecting the evidence continuously lets a single body of evidence satisfy several frameworks, which is far more efficient than running parallel compliance projects.