Summary

GDPR Article 6 requires that every instance of personal data processing has a documented legal basis. The six lawful bases are: If you process personal data on behalf of customers, GDPR Article 28 requires a written DPA between you and each controller you work with. Your customers will often request these before signing a contract. Article 25 requires that privacy protections are built into your product from the ground up — not bolted on afterward. For software companies, this means:

GDPR Requirements for Software Companies: A Complete Compliance Guide

Software companies occupy a unique position under the General Data Protection Regulation. You’re not just a business that happens to collect data — you’re often building the very tools that other businesses use to process personal data. That dual role creates layered obligations that many tech founders and CTOs underestimate until they’re facing a data breach or a regulatory inquiry.

This guide breaks down every major GDPR requirement relevant to software companies, whether you’re a B2B SaaS platform, a mobile app developer, or an enterprise software vendor.

Who Does GDPR Apply To?

GDPR applies to any organization that:

Is established in the European Union (EU) or European Economic Area (EEA), or
Offers goods or services to individuals in the EU, or
Monitors the behavior of individuals located in the EU

If your software has even a single EU-based user, GDPR applies to you. There is no revenue threshold or company size exemption, though some obligations are scaled for smaller organizations.

Understanding Your Role: Controller vs. Processor

One of the first things a software company must determine is whether it acts as a data controller, a data processor, or both.

Data Controller

A controller decides why and how personal data is processed. If your software collects user data to provide your service — account information, usage analytics, billing records — you are a controller for that data.

Data Processor

A processor handles personal data on behalf of a controller. If your platform processes data that your customers own (think: a CRM, HR software, or marketing automation tool), you are acting as a processor for that customer data.

Why This Distinction Matters

Your obligations differ significantly depending on your role:

Controllers must establish a lawful basis for processing, respond to data subject rights requests, and maintain Records of Processing Activities (RoPA).
Processors must sign Data Processing Agreements (DPAs), follow controller instructions, and report breaches to the controller without undue delay.

Many SaaS companies are both simultaneously — a controller for their own employee and marketing data, and a processor for their customers’ end-user data.

Core GDPR Requirements for Software Companies

1. Establish a Lawful Basis for Every Processing Activity

GDPR Article 6 requires that every instance of personal data processing has a documented legal basis. The six lawful bases are:

Consent — freely given, specific, informed, and unambiguous
Contract — processing is necessary to fulfill a contract with the user
Legal obligation — required by law
Vital interests — protecting someone’s life
Public task — performing a task in the public interest
Legitimate interests — your interests don’t override the individual’s rights

For most software companies, contract and legitimate interests are the most commonly applicable bases. Consent is often overused and is harder to maintain than many assume.

2. Maintain Records of Processing Activities (RoPA)

Under Article 30, organizations with 250 or more employees must maintain a RoPA. However, smaller companies are also required to keep records if their processing is likely to result in a risk to data subjects’ rights, is not occasional, or includes special category data.

In practice, every software company should maintain a RoPA. It documents:

Categories of personal data processed
Purposes of processing
Data retention periods
Third-party recipients and sub-processors
International data transfers

3. Draft and Sign Data Processing Agreements

If you process personal data on behalf of customers, GDPR Article 28 requires a written DPA between you and each controller you work with. Your customers will often request these before signing a contract.

A compliant DPA must include:

The subject matter and duration of processing
The nature and purpose of processing
The type of personal data and categories of data subjects
Your obligations and rights as a processor
Requirements to use sub-processors only with controller approval
Provisions for data deletion or return upon contract termination

4. Implement Privacy by Design and Default

Article 25 requires that privacy protections are built into your product from the ground up — not bolted on afterward. For software companies, this means:

Collecting only the minimum data necessary (data minimization)
Defaulting to the most privacy-protective settings
Anonymizing or pseudonymizing data where possible
Building access controls and encryption into your architecture
Conducting Data Protection Impact Assessments (DPIAs) for high-risk features

5. Publish a GDPR-Compliant Privacy Policy

Your privacy policy must clearly explain in plain language:

What personal data you collect and why
The lawful basis for each processing activity
How long you retain data
Whether you share data with third parties
Users’ rights and how to exercise them
Your contact details and, if applicable, your Data Protection Officer’s details

6. Honor Data Subject Rights

GDPR grants individuals eight rights that your software and processes must be able to support:

Right to be informed — via your privacy policy and notices
Right of access — provide a copy of their data within 30 days
Right to rectification — correct inaccurate data
Right to erasure — delete data when no longer needed (“right to be forgotten”)
Right to restrict processing — pause processing under certain conditions
Right to data portability — provide data in a machine-readable format
Right to object — opt out of processing based on legitimate interests
Rights related to automated decision-making — including profiling

Build internal workflows and, where possible, self-service tools to handle these requests efficiently.

7. Manage International Data Transfers

Transferring personal data outside the EEA requires an appropriate safeguard. Common mechanisms include:

Standard Contractual Clauses (SCCs) — the most widely used tool, updated by the EU in 2021
Adequacy decisions — for countries the EU has deemed to have equivalent protections (e.g., the UK, Japan)
Binding Corporate Rules — for multinational corporate groups

If you use US-based cloud infrastructure, analytics tools, or sub-processors, you likely have international transfer obligations to address.

8. Establish a Breach Response Process

Under Article 33, you must notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach that poses a risk to individuals. If the risk is high, you must also notify affected individuals directly.

Your incident response plan should include:

Clear internal escalation procedures
A breach assessment checklist
Template notifications for authorities and data subjects
A breach register to document all incidents, even those not reported

9. Appoint a Data Protection Officer (DPO) If Required

A DPO is mandatory if your company:

Is a public authority
Carries out large-scale systematic monitoring of individuals
Processes special category data (health, biometric, criminal records) at scale

Many software companies in the health tech, HR tech, or adtech space will need a DPO. Others may appoint one voluntarily as a best practice.

Special Considerations for SaaS Platforms

Sub-Processor Management

As a processor, you must maintain an up-to-date list of sub-processors (e.g., AWS, Stripe, Intercom) and notify your customers before adding new ones. This requires an ongoing vendor management process, not a one-time exercise.

Cookie Compliance

If your software includes a web interface, you need a cookie consent mechanism that meets GDPR and the ePrivacy Directive standards. Pre-ticked boxes and implied consent are not sufficient.

Employee Data

Your own HR data — employee records, payroll, performance reviews — is also subject to GDPR. Ensure your internal data handling practices are documented and lawful.

FAQ: GDPR Requirements for Software Companies

Does GDPR apply to my startup if we’re based in the US?

Yes, if you have users or customers in the EU, GDPR applies regardless of where your company is incorporated. You may also need to appoint an EU representative under Article 27.

What happens if we don’t comply with GDPR?

Fines can reach €20 million or 4% of global annual turnover, whichever is higher. Beyond fines, regulators can issue reprimands, order processing to stop, and require remedial action. Reputational damage from a public enforcement action can be equally costly.

How often should we review our GDPR compliance?

At minimum, annually — but also whenever you launch a new product feature, onboard a new sub-processor, enter a new market, or experience a significant change in your data processing activities.

Do we need a DPA with every SaaS tool we use?

Yes. If a vendor processes personal data on your behalf (e.g., your email marketing platform, your analytics provider, your customer support tool), you need a DPA in place. Most reputable vendors offer a standard DPA on request or in their legal documentation.

What is a DPIA and when do we need one?

A Data Protection Impact Assessment is a structured risk assessment for high-risk processing activities. It’s required when processing is “likely to result in a high risk” — for example, large-scale profiling, processing sensitive data, or using new technologies. It’s also a valuable internal governance tool even when not strictly required.

Get Compliant Faster With Ready-to-Use Templates

Building GDPR documentation from scratch is time-consuming, legally complex, and easy to get wrong. Our professionally drafted GDPR compliance template bundle gives software companies everything they need to get compliant quickly and confidently:

✅ Data Processing Agreement (DPA) template
✅ Privacy Policy template for SaaS platforms
✅ Records of Processing Activities (RoPA) spreadsheet
✅ Data Subject Rights Request response templates
✅ Breach notification templates (supervisory authority + data subjects)
✅ Sub-processor management tracker
✅ DPIA template with worked examples

Stop starting from a blank page. Our templates are written by compliance professionals, regularly updated to reflect regulatory guidance, and designed specifically for software companies.

👉 [Browse our GDPR template library and get compliant today →]