Does GDPR apply to my SaaS if I'm outside the EU? What a small SaaS actually has to do

Yes, GDPR applies to your SaaS if you offer it to people who are in the EU, even if your company is registered in Australia, the US, Singapore or anywhere else, and even if the product is free. For a small SaaS, what it actually has to do is a short list: appoint an EU representative (and a UK one if you sell there), sign data processing agreements with customers and suppliers, keep a written record of your processing, have a plan to report breaches within 72 hours, and answer people's data requests within a month.

This guide uses only the GDPR text, the European Data Protection Board (EDPB) and the UK's Information Commissioner's Office (ICO), all checked on 28 October 2026.

Does GDPR apply if I'm outside the EU?

Article 3(2) covers a controller or processor "not established in the Union" when its processing relates to:

• Offering goods or services to people in the EU, "irrespective of whether a payment of the data subject is required". A free plan counts.
• Monitoring their behaviour, as far as that behaviour takes place in the EU.

Recital 23 explains what offering means. The "mere accessibility" of your website, email address or contact details from the EU isn't enough. But using a language or currency used in an EU country, with the ability to order in it, or mentioning customers or users in the EU, can show you're offering services there.

The EDPB's territorial scope guidelines add more signs, including an international clientele, a .de or .eu domain, or a currency other than your own country's. They also say that when services are "inadvertently or incidentally" provided to someone in the EU, that processing falls outside GDPR.

Monitoring is wide too. The EDPB lists behavioural advertising and "online tracking through the use of cookies or other tracking techniques such as fingerprinting" as examples, though it also says not every online collection of EU data automatically counts.

In practice: if your pricing page shows euros, your testimonials include an EU customer, or your sign-up form accepts EU users and you run ad pixels on them, plan as if GDPR applies. The EDPB's small business guide puts it plainly: it applies to an organisation outside the EEA "selling goods or offering services, even for free, targeting individuals in an EEA country". It also applies when you're a non-EEA IT company processing data for an EEA business, which is exactly what a B2B SaaS does for its European customers.

What a small SaaS owes (checked 28 Oct 2026)

The EU representative (Article 27)

Article 27(1) is short: "Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union." The representative must be established in one of the EU countries where your users are, and regulators and users can contact them instead of, or as well as, you.

The exception in Article 27(2) needs all three of these together: the processing is occasional, it doesn't include large-scale processing of special categories of data (health, religion and so on) or criminal records data, and it's unlikely to result in a risk to people. The EDPB says processing is only "occasional" if it "is not carried out regularly, and occurs outside the regular course of business or activity of the controller or processor". For a SaaS whose product is the processing, that's a hard test to pass.

Appointing a representative doesn't shield you. Article 27(5) says it's without prejudice to legal action against you directly.

Data processing agreements (Article 28)

A B2B SaaS usually wears two hats. For your customers' data inside the product, you're normally their processor. For your own sign-ups, billing and marketing, you're the controller. Either way, Article 28 needs a written contract (electronic counts, under Article 28(9)) between controller and processor.

The contract must cover the subject matter and duration, the nature and purpose of processing, the type of personal data and categories of people, and the controller's rights. It must also bind the processor to:

• process only on documented instructions
• keep the data confidential
• take the security measures in Article 32
• only use sub-processors with the controller's prior written authorisation (Article 28(2)), and pass the same duties down
• help the controller with rights requests and breaches
• delete or return the data at the end
• allow audits

So you need a DPA you can hand to customers, and signed DPAs from your own suppliers: hosting, database, email, analytics and support tools. Keep a list of them, because that list is your sub-processor list.

Records of processing (Article 30)

Article 30(1) lists what a controller's record holds: your name and contact details (and your representative's), the purposes, categories of people and data, recipients, transfers outside the EU, retention periods where possible, and a general description of security. Processors keep a shorter record under Article 30(2).

Article 30(5) exempts organisations with fewer than 250 employees, but only "unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data". Any one of those brings the duty back. The EDPB's Be compliant page reads the exemption narrowly: small organisations don't have to "mention purely occasional activities in their record", such as a one-off event. Your product isn't a one-off event.

There's a change on the way. The EDPB said in July 2025 that under the Commission's proposal the exemption "would apply to an enterprise or organisation employing fewer than 750 people", unless processing is likely to be high risk. The European Parliament's procedure file) shows the agreed text was approved in committee on 2 July 2026, with a plenary vote forecast for 23 November 2026 (checked 28 Oct 2026). Until it's adopted and published, the 250 rule applies. Build the record now: you'll need it for customer security questionnaires anyway.

Breaches: the 72-hour clock (Articles 33 and 34)

Article 33(1) says the controller must notify the regulator "without undue delay and, where feasible, not later than 72 hours after having become aware of it", unless the breach is unlikely to result in a risk to people. Late notices must give reasons. A processor must tell the controller "without undue delay", and every breach must be documented, reported or not.

The EDPB's data breaches page says you're aware "when there is a reasonable degree of certainty that a security incident has occurred and compromised personal data", and that you can notify in phases if you don't have everything within 72 hours. It lists mistakes like sending an email to the wrong person and ransomware as breaches too. Where a breach is likely to be high risk, Article 34 says you also tell the people affected.

What happens if you get it wrong

Article 83 sets two ceilings:

Unlike the EU AI Act, Article 83 has no lower ceiling for small companies. Regulators weigh factors such as the nature and gravity of the breach, whether it was negligent, and how you cooperated.

The UK has its own version

The ICO says UK GDPR "also applies to organisations outside the UK that offer goods or services to individuals in the UK". Its guidance on representatives says you must appoint a UK representative if you have no UK branch, office or other establishment and you offer goods or services to, or monitor, people in the UK. You don't need one if your processing is "only occasional, of low risk", and avoids large-scale special category or criminal offence data. You authorise the representative in writing, can do it under "a simple service contract", and should publish their contact details on your website.

UK figures are from the ICO's fining guidance, checked 28 Oct 2026. Several ICO pages carry a notice that they're under review after the Data (Use and Access) Act, so recheck before you rely on them.

Common mistakes

• Thinking "we're not in the EU" settles it. Article 3(2) is about where your users are, not where you're incorporated.
• Reading the 250-employee exemption as a free pass. It falls away as soon as processing isn't occasional, which covers almost every SaaS.
• Planning around the 750 threshold. It's a proposal until it's adopted and published.
• Signing customers' DPAs without checking your suppliers. You can't promise sub-processor controls your own hosting contract doesn't give you.
• Forgetting the UK. UK GDPR has its own representative rule and its own regulator, the ICO.
• Treating a breach plan as optional. 72 hours goes fast over a weekend.

Checklist: one page a two-person SaaS can finish

1. Write down whether you offer your service to people in the EU or UK, or monitor them, and the date you decided.
2. Appoint an EU representative in writing, in a country where your users are, and a UK one if you serve UK users.
3. Put both representatives' contact details in your privacy notice and on your website.
4. Publish a privacy notice that tells people how and for what purposes you process their data, and check you have a legal basis for each purpose. The EDPB's basics page lists both as core steps.
5. List every supplier that touches personal data and file a signed DPA from each one. That list is your sub-processor list.
6. Write one DPA template covering the Article 28(3) points and offer it to customers.
7. Build your Article 30 record as a spreadsheet: purposes, data, people, recipients, transfers, retention and security.
8. Write a one-page breach plan: who decides, how you log awareness time, which regulator you tell, and a 72-hour deadline. Keep a breach log.
9. Set up a privacy inbox and a process to answer requests within one month.
10. Review all of this every six months, and check whether Omnibus IV has been adopted.

Where to go next

If you're working out how compliance costs fit your pricing, read how to price an AI product, and if your product uses AI, check the EU AI Act for small AI startups as well. If you'd like to compare notes with other founders selling SaaS into Europe from somewhere else, you can join Remote Builders: it's free, and you're in straight away.