Does My SaaS Need to Be GDPR Compliant?

If a person in the EU or the UK can sign up for your app, GDPR applies to you. It does not matter that your company is registered in Delaware, that you are a team of one, or that you never meant to sell in Europe. GDPR follows the user, not the business. The moment an EU resident can hand you their email, you are processing the personal data of someone GDPR protects, and the rules come with them.

Who does GDPR actually apply to?

GDPR applies to anyone who handles the personal data of people in the EU or UK, regardless of where the business is. Personal data is broader than most founders expect. It is not just names and card numbers. It is email addresses, IP addresses, cookie IDs, analytics events tied to a person, support messages, and anything that can single someone out. If your app collects any of that from an EU user, even passively through analytics, you are a data controller under GDPR.

• ▸You are almost certainly in scope if you have a signup form, a waitlist, a contact form, or analytics, and anyone in the EU or UK can reach your site.
• ▸Being outside the EU does not exempt you. GDPR specifically covers businesses outside the EU that offer goods or services to, or monitor, people in the EU.
• ▸Free does not exempt you either. Collecting emails for a free beta is still processing personal data.

What do I actually have to do?

You have to be honest and careful with people's data, and you have to be able to prove it. In practice, for a small SaaS, that comes down to a handful of concrete things rather than a binder of policies. Here is the short, real list.

1. 1.Publish a real privacy policy that says what you collect, why, how long you keep it, who you share it with (your hosting, analytics, email tools), and how someone contacts you about their data. A generic template is a start, but it has to match what your app actually does.
2. 2.Ask before you track. Non-essential cookies and analytics (Google Analytics, Meta Pixel, Hotjar) must not run until an EU visitor agrees. A banner that loads trackers before the click, or only has an 'Accept' button, is one of the most common and most flagged mistakes.
3. 3.Let people see and delete their data. Users have the right to access what you hold and to ask you to delete it. You need a way to honor that, even if it is a clear email address and a manual process at first.
4. 4.Have a lawful basis for what you do with data, and do not collect more than you need.
5. 5.Say where data goes. Most SaaS tools use US-based hosting, analytics, and email. If EU data leaves the EU, your policy should say so and name the safeguard you rely on.

What happens if I ignore it?

The headline numbers (up to 20 million euros or 4 percent of global turnover) are real, but they are aimed at large companies that knew better. For a small founder, the realistic risk is more ordinary and still expensive: a complaint from a user that lands on a regulator's desk, a formal letter you have to respond to, or a bigger customer walking away because you could not pass their security and privacy questionnaire. Any one of those can cost you far more time and money than getting the basics right would have.

How do I check where my app stands?

You can check a surprising amount yourself, from the outside, the same way a regulator or a privacy-conscious user would. Open your site in a fresh private window and watch what happens before you touch anything.

• ▸Open the browser network tab and reload, logged out. If analytics or ad scripts fire before you click anything on a cookie banner, that is consent-before-permission, and it is a problem in the EU.
• ▸Look for a privacy policy link in your footer. Open it. Does it actually describe what your app collects, or is it a placeholder?
• ▸Look for a way to request data deletion. If there is no path and no contact for it, you cannot honor a basic right.
• ▸Check your cookie banner. Is 'Reject' as easy as 'Accept', or is reject hidden or missing?

If that list makes you wince, you are normal, and you are also exactly who this is fixable for. The gaps are common and most have small, concrete fixes.

Can I just have it scanned?

Yes, and that is what the Compliance check is for. It scans your SaaS the way a regulator would, across GDPR, the EU AI Act, accessibility, and US privacy rules, and hands you a private list of what to fix, with the actual rule each issue touches, written so you can paste it straight into your AI coding tool. The report is private and never published. It is an automated scan and a starting point, not legal advice, and for anything high-stakes you should still talk to a lawyer. But it turns a vague, scary worry into a short, concrete to-do list.