GDPR (General Data Protection Regulation)

The General Data Protection Regulation (GDPR) is the European Union's comprehensive data-privacy and data-protection law, in force since May 2018, that governs how any organization — regardless of where that organization itself is based — collects, processes, stores, and protects the personal data of individuals located in the EU/EEA. GDPR is extraterritorial by design: a SaaS company headquartered in the US or elsewhere is still bound by GDPR the moment it has EU users or customers, and non-compliance carries real teeth — fines up to €20 million or 4% of global annual revenue, whichever is higher, for the most serious violations. For SaaS builders, GDPR compliance touches product and engineering decisions directly, not just legal paperwork: it requires a documented lawful basis for every category of personal data processed (consent, contractual necessity, legitimate interest, etc.), explicit and granular consent for non-essential tracking/cookies (driving the ubiquitous cookie-consent banners), a "right to erasure" (users can request their personal data be deleted, requiring engineering to actually support hard-deleting or anonymizing user records on request, not just soft-deleting), a "right to data portability" (users can request an export of their data in a machine-readable format), breach notification obligations (a reportable breach must typically be disclosed to regulators within 72 hours), and a formal Data Processing Agreement (DPA) with every sub-processor (e.g., your hosting provider, your email-sending service, your analytics tool) that touches EU personal data on your behalf. Many SaaS companies designate an EU data-residency option (hosting EU customer data specifically in EU-region infrastructure) as a paid enterprise feature to simplify compliance for privacy-sensitive customers. Concrete worked example: a SaaS company receives a GDPR erasure request from an EU user who canceled their subscription 8 months ago. Engineering must locate every system holding that user's personal data — the primary database, the CRM, the analytics platform (Mixpanel/Amplitude), backups, and the email-marketing tool — and either hard-delete or fully anonymize each record within the required response window (typically one month under GDPR), while retaining any data legally required for tax/accounting purposes under a documented separate lawful basis. This is exactly why GDPR-conscious SaaS architectures build "delete this user's data everywhere" as a first-class, testable engineering capability from day one, rather than a manual scramble triggered by the first real request. GDPR was also the template many other jurisdictions have since followed — California's CCPA/CPRA, Brazil's LGPD, and similar laws in dozens of other countries share the same core rights (access, deletion, portability) with regional variations, meaning a SaaS company that builds genuinely GDPR-compliant data infrastructure once is usually 80% of the way to compliant with most other major privacy regimes it will eventually need to satisfy as it expands internationally.