GDPR Compliance Checklist for SaaS Apps

Document whether each processing activity relies on consent, legitimate interest, contract, legal obligation, vital interest, or public task.

Consent banners must offer genuine choice — pre-checked boxes or bundled consent are non-compliant. Use a CMP like Cookiebot or Termly.

You must be able to prove when a user consented and what they agreed to. Log consent events in your database.

Withdrawing consent must be as easy as giving it. A visible link in every email footer and in account settings is the minimum.

Legitimate interest requires a three-part test: purpose, necessity, and balancing. Document this for each LI claim.

Explain clearly: what data you collect, why, how long you keep it, who you share it with, and how users can exercise their rights.

Any vendor that processes EU personal data on your behalf requires a DPA. Common examples: analytics tools, email providers, hosting.

Categorize cookies as necessary, functional, analytics, or marketing. List third-party cookies from embedded scripts.

Forms, sign-up flows, and survey links should have a brief notice explaining what data is collected and the legal basis.

Keep a changelog or version history. Email notice for material changes to terms is best practice (and sometimes required).

Users can request a machine-readable export of their data. Build an export endpoint that outputs JSON or CSV — don't rely on manual processes.

Deletion must propagate to all data stores: primary DB, caches, backups (on schedule), analytics, and third-party processors.

GDPR mandates response within one month. Document who handles requests, how they verify identity, and how they fulfill each type.

An email address like privacy(a)yourdomain.com is sufficient. A web form with an SLA is better.

Run test user creation and deletion. Check your database, analytics, and email provider to verify data is gone.

TLS for all connections. Encrypted database fields for sensitive data (PII, payment info). Document your encryption approach.

Data should not be kept longer than necessary. Set automatic deletion schedules for inactive accounts, logs, and analytics data.

Not every employee needs access to production user data. Role-based access controls and access logs demonstrate compliance.

GDPR requires notification to the supervisory authority within 72 hours of discovering a breach. Know your local DPA and have a template ready.

Data minimization is a GDPR principle. Audit your sign-up forms and analytics — every unnecessary field is a liability.

Create a data processing register listing every vendor, the data shared, the legal basis, and where data is processed.

The EU-US Data Privacy Framework (2023) provides an adequacy decision. Verify vendor certification at dataprivacyframework.gov.

Google Analytics requires consent banners for most EU use cases. Plausible, Fathom, or Umami can work without consent banners in many cases.

If your email provider processes data in the US, ensure SCCs are in place. Consider EU-based alternatives like Brevo or Mailcoach.

A RoPA is required for organizations of 250+ employees, but recommended for all. It's your audit evidence if the DPA investigates.