GDPR Checklist for SaaS Vendors Acting as Processors

Most B2B SaaS vendors act as processors under GDPR, handling personal data on a customer's instructions. Your checklist starts with confirming your role, then signing an Article 28 contract, controlling sub-processors, securing the data, helping customers with data subject requests and alerting them to breaches without delay.

Key takeaways

• A processor acts only on documented instructions from the controller.
• Article 28 lists what the processor contract must contain.
• Sub-processors need the controller's prior written authorisation, and you stay liable for them.
• A processor must alert the controller as soon as it learns of a breach. The controller has 72 hours where feasible to notify the authority.
• If you decide purposes and means yourself, you are treated as a controller for that processing.

Are you a controller or a processor?

You are a processor when you process personal data for a customer, on their instructions, to provide your service. You are a controller for your own data, such as your marketing contacts and your own staff. One company is often both, for different data sets.

What is on the GDPR checklist for SaaS vendors?

1. Map your data. List what personal data you process, whose it is, where it is stored and who can see it.
2. Confirm roles per data set. Processor for customer data, controller for your own.
3. Sign a data processing agreement. Article 28(3) requires a binding contract setting subject matter, duration, nature and purpose, data types and categories of data subjects, and the controller's rights and obligations.
4. Follow instructions. Process only on documented instructions, including on transfers outside the EU, unless law requires otherwise.
5. Bind your people. Persons authorised to process data must be under a confidentiality commitment.
6. Secure the data. Apply the measures in Article 32.
7. Manage sub-processors. Get the controller's specific or general written authorisation, tell them about changes if you have general authorisation, and flow the same obligations down by contract.
8. Help with data subject rights. Support access, deletion and similar requests from your customers.
9. Plan for breaches. Alert the controller as soon as you learn of one.
10. Delete or return data. At the controller's choice when the service ends, including copies, unless law requires storage.
11. Support audits. Provide information that shows compliance and allow audits and inspections.
12. Flag bad instructions. Tell the controller immediately if an instruction seems to breach data protection law.

How fast must breaches be reported?

The processor must alert the controller as soon as it becomes aware of a breach. The controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk individuals' rights and freedoms. A late notice must explain the delay. The controller must record every breach.

For a vendor, this means a customer-facing process that works faster than 72 hours: know who to tell, with what details, and who decides.

What do customers ask SaaS vendors?

Expect questions on your DPA, sub-processor list, hosting locations, encryption, breach process, deletion timing and audit rights. A public sub-processor list and a trust center answer many of them before the call.

Click through it at your own pace, or open it full screen.

Do certifications prove GDPR compliance?

No single certificate does. Article 28(5) says approved codes of conduct or certifications can help show sufficient guarantees. Security attestations such as SOC 2 or ISO 27001 support your Article 32 story but do not replace the contract and process work.

Frequently asked questions

Sources

• GDPR Article 28
• GDPR Article 33

This is general information, not legal advice.

Last reviewed: 19 October 2026.