GDPR compliance: a practical implementation guide for cloud-native SaaS teams

GDPR reaches you in one of two ways (Article 3). With an establishment in the EU or EEA — a subsidiary, an office, sometimes a small team — it covers processing in that establishment’s context, wherever the servers are. Without one, it still applies when you offer goods or services to people in the EEA or monitor their behaviour there. A US or Indian SaaS company with euro pricing, EU sales and analytics on EU users is in scope for that processing, and must designate in writing an Article 27 representative in a Member State where those people are, unless the processing is occasional and low-risk.

For a B2B SaaS company the trigger is usually commercial first. Every EU customer is a controller that may only use processors giving "sufficient guarantees" and must sign an Article 28 contract with you; its procurement team sends a data processing agreement (DPA) and sub-processor and transfer questions before the security review ends.

Ignoring it costs three ways. Fines reach €20 million or 4% of worldwide annual turnover, whichever is higher, and in ILVA (C-383/23, 13 February 2025) the Court of Justice confirmed that the cap uses the turnover of the whole undertaking, which can mean the group. Authorities can order processing or transfers to stop: the Irish DPC’s €530 million TikTok decision (May 2025) conditionally ordered transfers to China suspended; staff there had accessed EEA user data remotely. Individuals can claim damages under Article 82. Most SaaS companies feel the commercial cost first: a deal stalled because the customer’s DPO will not sign off.

The Regulation has 99 articles in 11 chapters, read with 173 recitals; every article is in the library below. It is not a control catalogue: it asks for measures "appropriate" to the risk, so two companies on the same stack can make different, equally defensible choices — if each documents why. Five chapters do most of the work:

• Chapter II — principles and lawful bases. Article 5: lawfulness, fairness and transparency; purpose limitation; minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. Article 6 gives six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. SaaS companies rely mostly on contract (running the account), legal obligation (invoicing records) and legitimate interests (security monitoring, fraud prevention, B2B marketing, each with a written balancing test). Consent mostly covers non-essential cookies, also governed by the ePrivacy Directive.
• Chapter III — data subject rights (Articles 12–23), answered within one month, extendable by two further months for complex or numerous requests.
• Chapter IV — controllers and processors (Articles 24–43): by design and default, processor contracts, records, security, breaches, DPIAs and DPOs. Several duties switch on only above a threshold, so scoping decides how much applies.
• Chapter V — transfers (Articles 44–50) and Chapter VIII — remedies and fines (Articles 77–84).

What changed, and what has not. No amendment to the text is in force. Regulation (EU) 2025/2518 adds procedural rules for cross-border enforcement from 2 April 2027. The EDPB consulted on common DPIA (April 2026) and breach-notification (June 2026) templates. Two amending proposals are not law. The Commission’s Digital Omnibus (COM(2025) 837, November 2025) would require notifying authorities only of high-risk breaches, within 96 hours instead of 72, through a single EU reporting point; codify a relative definition of personal data; and add an AI legitimate-interest provision. In early October 2026 Parliament’s lead committees had not voted and the Council had no negotiating mandate. Omnibus IV (COM(2025) 501) would widen the Article 30(5) records exemption beyond the current 250-employee threshold (to 750, as proposed); the text agreed with the Council was approved in committee on 2 July 2026 and still needs plenary and Council votes. Build to the current text.

Scope is every processing activity that touches personal data, not a boundary around a product. Map four things.

1. A role per activity, using the EDPB’s controller and processor guidelines. Customer content and end-user records: processor. Account admins, billing, support tickets, marketing, website analytics, staff: controller. Telemetry and security logs: usually controller, because you decide why they exist. Reusing customer data to train your own models or benchmark tenants makes you a controller for that purpose (Article 28(10)); deciding purposes with a partner can make you joint controllers.
2. A data map: categories, data subjects, systems (databases, buckets, warehouses, logs, backups, SaaS tools), regions, recipients and retention. It becomes your Article 30 records, controller and processor versions. The under-250-employees exemption falls away when processing is not occasional, and a platform’s never is.
3. Establishments. An EU main establishment gives you one lead supervisory authority. Without one there is no one-stop-shop, and the EDPB’s breach guidelines require a non-EEA controller to notify every authority whose residents are affected.
4. Transfers, including access: an engineer in Bengaluru querying an EU database, a US support team reading tickets, a sub-processor’s follow-the-sun desk.

The UK is a separate regime. UK GDPR now diverges through the Data (Use and Access) Act 2025, whose data protection provisions the ICO says were all in force by 19 June 2026: "recognised legitimate interests" that need no balancing test, significant automated decisions allowed on more lawful bases, with safeguards, except for special-category data, subject-access searches limited to what is reasonable and proportionate, consent exemptions for some analytics and functionality cookies, a reworded transfer test, and a complaints process that acknowledges within 30 days. The Commission renewed the UK adequacy decision on 19 December 2025 until 27 December 2031, so EU-to-UK flows need no SCCs.

The costliest scoping mistakes: claiming to be "just a processor", leaving logs and warehouses off the map, and treating EU hosting as the end of the transfer question.

The plan assumes a 20–300 person SaaS company, mostly a processor, on one or two hyperscalers. Shift the weeks; keep the order.

Weeks 0–3: ownership and the map

• Name an accountable executive and a privacy lead. Decide whether Article 37 requires a DPO; Germany’s BDSG section 38 adds a duty where at least 20 people are constantly involved in automated processing. Without an EU establishment, appoint the Article 27 representative now.
• Build the data map from discovery scans and interviews with every datastore and SaaS-tool owner; tag cloud resources with owner and classification.
• Deliverables: role matrix, data map, draft controller and processor records, gap register.

Weeks 3–8: contracts, transfers, transparency

• Publish a customer DPA covering every Article 28(3) term: documented instructions, confidentiality, Article 32 security, sub-processor authorisation and objection, help with rights requests, breaches and DPIAs, deletion or return at the end, and audits. Annex the security measures you actually run.
• Publish a sub-processor list with purpose, location and transfer mechanism, a notice period for changes and an objection route.
• Paper each transfer: an adequacy decision (including the DPF for certified US recipients) or the 2021 SCCs — module 2 controller-to-processor, module 3 processor-to-processor — with a transfer impact assessment.
• Rewrite privacy notices (Article 13) to name purposes, lawful bases, retention and the third countries involved; €45 million of the TikTok fine was for not naming them.
• Deliverables: DPA and annexes, public sub-processor page, transfer register with assessments, legitimate-interest assessments, updated notices.

Weeks 6–16: engineering and assessments

• Region pinning, keys, data-access logging, retention, a DSAR pipeline and a breach runbook (next section).
• DPIAs for anything meeting an Article 35 trigger, your authority’s published list, or two of the EDPB-endorsed WP248 criteria — AI features that score people, employee monitoring, large-scale location or health data, new combinations of datasets.
• Deliverables: configuration exports per control, a completed test DSAR, a breach tabletop with timings, signed-off DPIAs.

Ongoing

• A privacy check in change management for new data, vendors, regions or purposes; quarterly sub-processor and transfer reviews; an annual refresh of records, DPIAs and training; a watch on the Omnibus files and DPF litigation.

"Done" means a configuration export, a record and your DPA annex all say the same thing.

Articles 44–46 — data residency and transfers

• AWS: a service control policy denying requests outside approved Regions on aws:RequestedRegion, with documented exemptions for global services such as IAM and CloudFront; the AWS European Sovereign Cloud (generally available January 2026) for EU-only operations. Azure: the built-in Allowed locations policy at management-group scope; Microsoft’s EU Data Boundary, completed February 2025, keeps customer, pseudonymised telemetry and support data in the EU and EFTA, with listed exceptions. GCP: the gcp.resourceLocations organisation policy; Assured Workloads EU Data Boundary packages, where "EU Data Boundary and Support" also limits support to EU personnel.
• Residency is not a transfer tool: access from outside the EEA is still a transfer. The EU–US Data Privacy Framework covers only US organisations on the Department of Commerce list. The General Court upheld it in Latombe (T-553/23, 3 September 2025) and an appeal (C-703/25 P) is pending. On 29 June 2026 the US Supreme Court’s Trump v. Slaughter ended for-cause removal protection for FTC commissioners, whose independence the adequacy decision cites, and on 31 July the EDPB asked the Commission to assess the effect. The decision remains in force; keep SCCs signed as the fallback.

Article 32 — encryption and key management

• AWS: KMS customer-managed keys per data class, key policies separating key administrators from data users, the External Key Store where customers insist on keys outside AWS. Azure: Key Vault or Managed HSM keys on Storage, SQL Database and Cosmos DB, with purge protection. GCP: Cloud KMS CMEK, plus Cloud EKM and Key Access Justifications for external key custody.
• Done: every store of personal data under a key you control, logged key use, and a risk-to-measure table.

Articles 33–34 — access logging and the 72-hour clock

• Default logs miss data reads, so you cannot scope a breach. AWS: CloudTrail S3 data events and database activity streams or pgaudit. Azure: diagnostic settings with StorageRead, and Azure SQL auditing. GCP: Data Access audit logs, off by default except for BigQuery. Ship them to S3 Object Lock, immutable Blob storage or a locked log bucket.
• Controllers notify within 72 hours of becoming aware; processors notify controllers "without undue delay", so put an hour count in the DPA. Every breach goes in the Article 33(5) register, notified or not; Article 34 adds notice to individuals when risk is high.
• Done: a tabletop timeline from alert to draft notification, and a register with each notify-or-not decision and its reason.

Articles 5(1)(e) and 17 — retention and deletion

• AWS: S3 Lifecycle expiration, DynamoDB TTL, CloudWatch Logs retention, AWS Backup lifecycle. Azure: Blob lifecycle management, Cosmos DB TTL, Log Analytics retention. GCP: Object Lifecycle Management, BigQuery table and partition expiration, Cloud Logging bucket retention.
• Done: every datastore has a TTL or a documented exception; tenant offboarding deletes within the contractual period and logs it; backups age out within a stated window.

Articles 15–20 — data subject requests

• As a processor, give customer admins self-service export and deletion plus an API. As a controller, answer within one month, with portable JSON or CSV output.
• Keep a subject index mapping user ID and email to every store, seeded by discovery: Amazon Macie for S3, Microsoft Purview for Azure, Sensitive Data Protection for BigQuery and Cloud Storage. Microsoft Priva is built for Microsoft 365 data, not your product.
• Done: a timed end-to-end test request covering warehouse, logs, CRM and support desk.

Article 25 — pseudonymisation by design

• Tokenise identifiers before analytics and non-production: AWS KMS HMAC keys; Sensitive Data Protection deterministic or format-preserving encryption on GCP; dynamic data masking for Azure SQL support views. Hold the key in a separate account owned by another team.
• Pseudonymised data stays personal data for whoever can re-identify it; in EDPS v SRB (C-413/23 P, September 2025) the Court of Justice held it may not be for a recipient without the means.

Article 28(2) and (4) — sub-processors

• Hyperscalers publish DPAs and sub-processor lists: AWS in its Service Terms and sub-processor page, Microsoft in the Products and Services DPA and Service Trust Portal, Google Cloud in its Data Processing Addendum and subprocessors page.
• Under EDPB Opinion 22/2024, controllers should know every sub-processor down the chain, and processors must actively flag changes.
• Done: the public list reconciles with billing and SSO app inventories, and each entry has a signed DPA and a transfer mechanism.

Accountability (Articles 5(2) and 24) means an authority or customer can ask you to demonstrate compliance and you must produce it. File evidence by processing activity and article, dated and owned.

• Governance: data protection policy, retention schedule, breach and DSAR procedures, DPO designation and its notification to the authority (Article 37(7)), the Article 27 mandate, training completion.
• Records and assessments: Article 30 records; legitimate-interest assessments; DPIAs and any Article 36 prior consultation; transfer impact assessments; proof of consent where consent is the basis (Article 7(1)); the breach register; a DSAR log with dates and outcomes.
• Contracts: customer and sub-processor DPAs, executed SCCs with completed annexes, dated checks of recipients’ DPF certification, joint-controller arrangements.
• Technical exports: region policies, key configuration, audit-log settings, lifecycle and TTL rules, deletion-job output, access reviews, and the regular testing Article 32(1)(d) requires — penetration, restore and vulnerability results.
• Tickets: change-management privacy reviews, sub-processor notices to customers, incidents linked to the register.

Retention. GDPR sets no period for compliance evidence. Keep records and contracts while the processing runs, then for the limitation period for regulatory action and damages claims in your main jurisdictions, as written in your retention schedule. DSAR logs, breach registers and consent logs hold personal data too, so minimise them.

There is no GDPR audit to schedule and pass; three parties test you on their own timetable.

Customers are the most frequent assessor: DPA negotiation, a privacy questionnaire, sub-processor and transfer questions, and Article 28(3)(h) audit rights. Most accept a SOC 2 report or ISO 27001 certificate plus a questionnaire instead of an on-site audit.

Supervisory authorities act on complaints (Article 77), breach notifications, own-volition inquiries and sector sweeps. Article 58 powers include information orders, audits, compliance orders, temporary or permanent bans and suspension of transfers. In cross-border cases the lead authority drafts a decision, other authorities can object, and the EDPB settles disputes by binding decision (Article 65); from April 2027 Regulation 2025/2518 harmonises admissibility, procedural rights and deadlines. Fines follow the Article 83(2) factors — gravity, duration, intent or negligence, mitigation, history, cooperation, the data affected and whether you reported it yourself. Most Chapter IV duties sit in the €10 million or 2% tier; principles, lawful bases, rights and transfers in the €20 million or 4% tier.

Certification under Article 42 is voluntary. Europrivacy, an EDPB-approved European Data Protection Seal, was extended in April 2026 to non-EEA companies under Article 3(2), and a version recognised as a transfer tool for non-EEA importers. ISO/IEC 27701 is not a GDPR certification but is common evidence of Article 28 guarantees.

Cost drivers: a DPO, representative fees, counsel time on DPAs and transfer assessments, residency, retention and DSAR engineering, the number of sub-processors and countries, and AI features needing DPIAs.

1. "We are a processor, so GDPR is the customer’s problem." Your account, marketing, telemetry and HR data make you a controller. Fix: a role per activity, and a controller record alongside the processor one.
2. EU hosting treated as the transfer answer. Support and engineering access from outside the EEA is a transfer; the Dutch authority fined Uber €290 million for sending drivers’ data to its US headquarters for over two years without a transfer tool. Fix: list access-based flows and cover each with SCCs or the DPF plus an assessment.
3. A DPA that promises what engineering does not do. "Deleted within 30 days, including backups" when backups live 90. Fix: write the annex from configuration exports and keep them in step.
4. A stale sub-processor list. A team adopts a new LLM API and customers find out from a questionnaire. Fix: a procurement gate tied to SSO and billing, with notice before go-live.
5. Logs as a shadow database. Request bodies, emails and IP addresses kept indefinitely. Fix: redaction at the logger, retention on every log group, logs on the data map.
6. DSARs that search only production. The warehouse, CRM, support desk and logs hold more. Fix: a subject index and a quarterly test request.
7. The breach clock started at the post-mortem. Awareness means reasonable certainty that personal data was compromised, not a finished investigation. Fix: timestamp awareness at triage; notify in phases if facts are incomplete.
8. DPIAs written after launch. An AI scoring feature ships and the assessment is reverse-engineered. Fix: a screening question in design review, signed off before release.

iCompaas is not a supervisory authority, a law firm or your DPO, and it cannot make the controller-or-processor call for you; it is the system of record underneath the programme. The records-of-processing (RoPA) module holds your Article 30 records. A DPIA workflow supports your impact assessments. DSAR intake tracks each request through to fulfilment against its deadline. The vendor and processor register records each sub-processor with its SCC version, and the breach-notification playbook runs the 72-hour clock and drafts the supervisory-authority report and individual notices. Continuous checks run across your connected AWS, Azure, GCP and other cloud accounts, so configuration drift shows up between reviews rather than in a customer’s due diligence. Policy templates come with owners and review cadences; evidence is collected as controls run and exported when a customer or authority asks. The 99-article library on this page explains each article in engineering terms; the legal judgements remain yours.