GDPR for US SaaS Companies

What is the GDPR for a US SaaS company?

The General Data Protection Regulation (GDPR) is the European Union law on personal data: any information about a person who can be identified. It does not stop at the EU border. Under Article 3(2), it covers a company outside the EU when it offers goods or services to people in the EU, paid or free, or monitors their behavior there.

The law gives each company a role. A data controller decides why and how data is used. A data processor handles data on the controller's behalf (Article 4). A B2B SaaS company is often a processor for its customers' data and a controller for its own marketing and account data. Your vendors are processors for you, and their vendors are subprocessors.

A company with no EU office that falls under Article 3(2) may also need to appoint a representative in the EU in writing. Article 27 has an exception for occasional, low-risk processing that does not involve sensitive data on a large scale.

What it looks like in a vendor's terms

GDPR terms often sit in the vendor's data processing agreement (DPA). A typical clause reads like this:

We process Customer Personal Data only on your documented instructions. Our staff are bound by confidentiality. We may use subprocessors listed on our website and will tell you before adding a new one, and you may object. We will notify you without undue delay after becoming aware of a personal data breach. When the services end, we will delete or return the data at your choice.

• Documented instructions: the vendor may use the data only for the job you hired it for.
• Subprocessors: the vendor needs your general or specific permission to use other processors, and must tell you about changes so you can object.
• Breach notice: the vendor tells you, so you can meet your own deadlines.
• Delete or return: what happens to your data at the end.

These points come from Article 28, which lists what a processor contract must contain. Stripe's DPA, for example, says breach notice for GDPR data "will be no later than 48 hours" after Stripe becomes aware.

A real change we caught

Venpo flagged that Klaviyo no longer promises to pass privacy requests on to you. Under Article 28, a processor must help the controller respond to people exercising their data rights, so a change to that promise is worth reading closely.

Why it matters to you

Deadlines. Under Article 33, a controller must tell the regulator about a breach without undue delay and, where feasible, within 72 hours. A processor must tell the controller "without undue delay." The 72 hours is the controller's clock, so your vendor's notice promise decides how much of it you have left.

Fines. The top tier under Article 83 is up to 20 million euros or 4% of worldwide annual revenue, whichever is higher.

Transfers. Sending EU data to the US needs a legal basis under Chapter V, such as standard contractual clauses or the EU-US Data Privacy Framework. As of October 2026, the US is on the European Commission's adequacy list for companies in that framework.

Your customers. EU customers will hand you their DPA. Whatever you promise them, you need your own vendors to promise you.

What to check

• A signed or accepted DPA with every vendor that touches EU personal data.
• The breach notice period in hours or days, not just "without undue delay."
• How the vendor tells you about new subprocessors and how long you have to object.
• The transfer mechanism the vendor relies on for data leaving the EU.
• Whether the DPA can change without your signature.

Data Protection Officer (DPO)

Read the full page on Data Protection Officer (DPO)

A Data Protection Officer (DPO) is the person who advises a company on the GDPR and watches how it handles personal data. Under Article 37, a controller or processor must appoint one in three cases: it is a public body, its core activities involve regular and systematic monitoring of people on a large scale, or its core activities involve large-scale processing of sensitive data or criminal records.

A small SaaS company may fall outside all three, but check your own activities. A product built around tracking user behavior at scale may qualify. If you appoint a DPO, Article 38 says the DPO must report to the highest management level, take no instructions on how to do the job and not be dismissed or penalized for doing it.

UK GDPR

Read the full page on UK GDPR

The UK GDPR is the United Kingdom's version of the GDPR, kept after Brexit. The rules are close to the EU text, but the UK has its own regulator, the Information Commissioner's Office, and its own transfer tools.

For data leaving the UK, the ICO lists the International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, and the UK Extension to the EU-US Data Privacy Framework for US recipients. In the other direction, the European Commission renewed its decision that UK protection is adequate on 19 December 2025.

For you, the practical point is that a vendor's DPA should name UK GDPR as well as the EU GDPR if you have UK users. Stripe's DPA, for example, covers both and lists the UK Addendum as a transfer mechanism.

Quebec Law 25

Read the full page on Quebec Law 25

Quebec Law 25 is the update to the Canadian province of Quebec's private-sector privacy law. It borrows several ideas familiar from the GDPR, such as privacy impact assessments, notices about automated decisions and privacy settings set to the most protective level by default. It came into force in stages: most obligations took effect on September 22, 2023, and the right to data portability on September 22, 2024, according to Quebec's privacy regulator.

It matters if you have customers, users or employees in Quebec. Vendor DPAs often do not name it. Stripe's main DPA, for example, defines data protection law to include "provincial" laws without naming a Canadian statute. If Quebec data matters to you, ask your vendors whether their DPA covers it by name.

How Venpo helps

Venpo watches the DPAs, privacy policies and subprocessor lists of the vendors you add and emails you a plain-English alert when breach notice terms, subprocessors or transfer language change. Each vendor gets a change history you can show an auditor or a customer.