Sage-Tips

Does GDPR apply to SaaS?

The GDPR For The SaaS Industry Organizations must ensure that they process the data on a lawful basis. This often means that they must obtain valid consent from the individuals concerned before processing their data. Robust protection practices and safeguards must also be implemented for the processing.

Does GDPR apply to apps?

The General Data Protection Regulation (GDPR) is an important and globally-influential data and privacy law from the European Union. The GDPR applies to mobile apps that collect and process personal data of EU citizens. It doesn’t matter if your app is operated from outside of the EU.

How does SaaS become GDPR compliant?

GDPR checklist for SaaS companies

1. Appoint an internal Data Protection Officer (DPO)
2. Create a detailed cookie policy.
3. Update the content and language of your privacy policy.
4. Update your cookie consent banner.
5. Create a record of data processing flows.
6. Inquire whether your third-party vendors are compliant or not.

How do I know if an app is GDPR compliant?

In order to make sure that your app is GDPR compliant, you need to:

1. Add checkboxes to your signup forms (if you don’t have them yet).
2. Check what tracking codes you have in your app.
3. Update Privacy Policy.
4. Update your Terms of service (also known as Terms of use or Terms and conditions).

Is SaaS a data processor?

SaaS platforms also maintain the control of any collected data and can decide how that data is processed. As such, a SaaS business is both the data controller and data processor.

Is SaaS a processor or controller?

Where a SaaS supplier does not have any purpose of its own for processing the personal data and they only act on a SaaS customer’s instructions, they are a data processor – even if the SaaS supplier make some technical decisions about how to process the personal data.

Does an app require cookie consent?

The ePrivacy Directive (also known as Cookie Law) requires users’ informed consent before storing cookies on a user’s device and tracking them. This means that if your app (or any third-party service used by your app) uses cookies, you must first obtain valid consent prior to the installation.

Does GDPR apply to WhatsApp?

WhatsApp should be used as a communication channel for information only, not as a means to share personal data or confidential information. Because of the WhatsApp T&C, businesses can only rely on the privacy policy of WhatsApp but, in case of breach, they are liable in accordance with Art. 5 GDPR.

How do I make my app GDPR compliant?

How to Make Your App GDPR Compliant?

1. Think about the data you collect from users.
2. Analyze how you handle user data.
3. Ask for permission.
4. Encrypt the data that users give you.
5. Use two-factor authentication.
6. Educate and inform your users.
7. Delete the information of users who opt out.
8. Encrypt the data that users give you.

How do I prove GDPR compliant?

To do this, you will need documented evidence of your:

1. Data protection policy.
2. Training policy.
3. Information security policy.
4. DPIA (data protection impact assessment) procedure.
5. Retention of records procedure.
6. Subject access request form and procedure.
7. Privacy procedure.
8. International data transfer procedure (where relevant)

Is a SaaS provider a controller or processor?

Does processing of SaaS login credentials make you a data controller?

In order to collect and process personal data, you need a lawful basis for doing so. As a SaaS, you will most likely be both: you are a controller for data which you collect yourself (e.g. your user database and newsletter subscriptions), and a processor for data which your customers store in your SaaS product.

What does the GDPR mean for SaaS companies?

The GDPR encourages businesses to be more aware of the data they collect and what they do with it, and gives individuals much more control over what happens to their data. We’re currently working hard towards compliance, and are happy to see that most other SaaS providers are doing the same.

Do you need a data protection officer for your SaaS business?

Since personal data processing is a core activity for many SaaS businesses, you need to appoint a Data Protection Officer (DPO) tasked with making sure all personal data is handled properly, and register the DPO with the local data protection authorities.

What is the general data protection regulation (GDPR)?

The GDPR, an abbreviation for General Data Protection Regulation, is a data law that was introduced in the EU on 25 May 2018. The purpose of the GDPR is to provide data protection to citizens in EU countries and to provide them with more control over their personal data.

How can you ensure your business is GDPR compliant?

If you employ third-party processors (e.g. a cloud provider or email service), you must make sure they process the data in a manner that is compatible with your terms and the GDPR – likewise, as a processor you should provide your customers (the controllers) with terms and tools which allow them to be GDPR compliant. That’s pretty much it.