By business type

GDPR Policy Generator for SaaS

Written for the controller/processor split, sub-processor lists, DPAs and enterprise security review.

Generate your GDPR policy Read the GDPR policy guide

For a SaaS business, GDPR compliance is largely a documentation exercise aimed at two audiences: the regulator, and your customers’ procurement teams. The second audience is more demanding, and the artefacts overlap almost entirely.

A SaaS company wears two hats simultaneously, and the single biggest failure in SaaS privacy documentation is not separating them. For your own marketing site, billing and support you are a controller. For the customer data your users push into the product you are a processor, acting on their instructions - and the disclosures, the rights, and the deletion obligations are completely different in each role.

That distinction is not academic. It determines who answers a data subject access request, who notifies a regulator after a breach, who signs which contract, and what your policy is allowed to promise. A privacy policy that describes customer-uploaded data as "your data that we use to improve our services" is describing processor data in controller language, and enterprise security reviewers will catch it.

The commercial layer matters as much as the legal one. Every enterprise deal now runs through a security questionnaire that asks for a data processing agreement, a published sub-processor list with change notification, a defined breach notification window, and a sub-processor change-objection right. Having those documents ready shortens sales cycles; not having them stalls deals at procurement.

What a GDPR policy for a SaaS product has to cover

Article 30 records for both your controller and processor roles, kept separately
An Article 28 DPA available for signature, with SCCs and the UK Addendum attached
A sub-processor list with locations, purposes and a change-notification process
A DPIA where your processing profiles users or handles special category data at scale
A breach process meeting both the 72-hour regulator deadline and your contractual customer commitments

How a SaaS product actually moves personal data

Customer-uploaded content (processor role)

Whatever your users put into the product, including personal data about their own customers and staff. You process it on instruction, you do not decide its purposes, and you cannot use it for your own ends without a separate basis.

Account, billing and usage data (controller role)

Names, work emails, plan, invoices, feature usage and login history. This is yours to decide about, and your privacy policy is the notice for it.

Product analytics and session recording

Tools like Amplitude, PostHog or a session recorder capture in-app behaviour - which frequently means capturing customer data as a side effect, turning an analytics decision into a processor problem.

Support tickets and screenshots

The fastest route by which processor data ends up in a controller system. A screenshot attached to a ticket lands in a helpdesk with a different retention policy.

AI features processing customer content

If your product sends customer data to a model provider, that provider is a sub-processor, and whether the data is used for training is the first question every enterprise reviewer asks.

Sales and marketing enrichment

Buying contact data and enriching leads is controller processing with a legitimate interests analysis and a notification duty under Article 14 to people whose data you did not collect from them.

Third parties the draft will ask you about

AWS or Google Cloud · Stripe · Twilio and SendGrid · Intercom or Zendesk · Amplitude or PostHog · Datadog or Sentry · HubSpot or Salesforce · OpenAI or Anthropic · Snowflake

The rules that apply

GDPR Article 28

Processor obligations: process only on documented instructions, confidentiality, security, sub-processor authorisation, assistance with rights and breaches, deletion or return at the end, and audit rights.

Sub-processor transparency

Not a statutory list requirement in itself, but the practical standard: a published list, and advance notice with an objection window before adding to it.

Transfer mechanisms in the contract chain

SCCs and the UK Addendum have to flow down to sub-processors, not just sit in the top-level agreement.

Breach notification, contractual and statutory

As a processor you notify your customer without undue delay; as a controller you notify the regulator within 72 hours in the UK and EU.

US state law service-provider terms

CCPA requires specific contract language for a recipient to count as a service provider rather than a sale.

What the generated GDPR policy contains

Article 13 and 14 transparency notice
The full disclosure set, split by whether the data came from the person or from somewhere else.
Lawful basis register
Every processing activity mapped to one of the six bases, with the legitimate interests assessment written down where you rely on that basis.
Records of processing (Article 30)
The internal register a supervisory authority can ask for at any time, covering purposes, categories, recipients, transfers and retention.
Data subject rights procedure
How a request arrives, how identity is verified, who handles it, and the one-month clock with its two-month extension.
International transfer mechanism
Adequacy, SCCs with a transfer impact assessment, or the UK IDTA/addendum - named per destination, not asserted in general.
Breach detection and 72-hour notification
The internal escalation path, the assessment test, and the template for notifying the regulator and, where required, the individuals.
Processor and sub-processor controls
Article 28 terms, the sub-processor list, and the change-notification commitment your customers will ask for.

The SaaS compliance document set

Separate the privacy policy from the DPA
The policy covers you as controller. The DPA covers you as processor. Different audiences, different content, different signatures.
Publish a sub-processor list with a subscribe option
Name, purpose, location. Offer email notification of changes and an objection window.
Write the security page procurement actually asks for
Encryption, access control, testing cadence, incident response, and whatever certification you hold - or an honest statement that you hold none yet.
Define the breach notification window in the DPA
A stated number of hours, and an internal process that can meet it.
Decide and document your AI data position
Whether customer content reaches a model provider, whether it is used for training, and how long the provider retains it.
Build deletion and export that actually work
Article 28 requires deletion or return at the end of the relationship, and enterprise contracts require proof.

Where this usually goes wrong

One document covering both roles

The privacy policy describes controller processing. Processor obligations belong in the DPA. Merging them produces a document that over-promises about customer data and under-explains your own.

Training on customer data without saying so

The single fastest way to lose an enterprise deal, and depending on your terms, a breach of the instruction limitation in Article 28.

A sub-processor list that is out of date

If the contract promises notice before adding a sub-processor, adding one silently is a breach of contract as well as a transparency failure.

Support tooling that copies processor data into controller systems

Screenshots, exported CSVs and debug logs move data out of the environment your DPA describes.

No defined breach notification window

"Without undue delay" is the statutory phrase, but enterprise contracts want a number. Not having one is a negotiation cost on every deal.

Free-tier and trial data treated casually

Trial accounts contain real customer data far more often than teams assume, and the same obligations apply.

Frequently asked questions

Is my SaaS company a controller or a processor?

Both, in different respects. You are a controller for your own account, billing, marketing and support data, and a processor for the data your customers put into the product. The documents you publish should make the boundary obvious.

Do I need a data processing agreement?

If you process personal data on behalf of business customers subject to GDPR or UK GDPR, yes - Article 28 requires it in writing. In practice enterprise customers will require one regardless of jurisdiction.

Do I have to publish a sub-processor list?

There is no free-standing statutory duty to publish one, but almost every enterprise DPA requires notice before you add a sub-processor, and a public list is the standard way to meet that.

Can I use customer data to train AI models?

Only with a lawful basis and, where you are a processor, only if your customer has instructed or permitted it. Doing it silently breaches the instruction limitation and, for most enterprise contracts, the agreement itself.

What breach notification window should I commit to?

Common commitments run from 24 to 72 hours from confirmation. Pick one your incident process can actually meet, because a missed contractual deadline is a breach of contract on top of the incident.

Does GDPR apply to a business outside the EU?

Yes, where you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) is about where the person is, not where you are - and Article 27 may also require you to appoint an EU representative.

What is the difference between EU GDPR and UK GDPR?

The text is nearly identical, but they are separate laws with separate regulators, separate fine ceilings in different currencies, and separate transfer regimes. A business serving both needs both named, not "GDPR" as shorthand.

Do I need a Data Protection Officer?

Only where your core activities involve large-scale regular monitoring or large-scale special-category data, or you are a public authority. Many businesses do not need one - but if you do not have one, say who is accountable instead.

Is a GDPR policy the same as a privacy policy?

No. The privacy policy is the outward-facing notice. The GDPR policy set is the internal machinery - lawful basis register, ROPA, rights procedure, breach plan - that lets you answer a regulator when they ask how the notice is honoured.