GDPR when your users are in Europe

GDPR governs personal data of people in the EU — collection, use, storage, and transfer — regardless of where the company processing it sits. For a B2B SaaS company the practical shape is usually the processor role: your customer is the controller, you process on their instructions, and a Data Processing Agreement (DPA) makes your obligations contractual.

There is no GDPR certificate. Compliance means your practices, documentation, and contracts genuinely meet the regulation — and can survive a customer’s privacy team reading them closely.

Any company with users, customers, or monitored individuals in the EU or UK (which retained its own near-identical version). For Canadian SaaS the trigger is rarely a regulator — it’s a customer’s procurement team asking for your DPA, your transfer mechanism, and your sub-processor list before they sign.

A data map (what personal data, where, why), lawful bases for what you do with it, a solid DPA with Standard Contractual Clauses for transfers, a sub-processor register, processes for data-subject rights, and breach notification readiness (72 hours to the authority, via your customer). Depending on your processing, an EU representative or DPO may be required.

On top of an honest security program, this is weeks of focused work. Without one, the security half (Article 32) is the long pole.

GDPR’s security requirements overlap heavily with SOC 2 and ISO 27001 controls — Article 32 is essentially “have an appropriate security program.” What GDPR adds is the privacy layer: data mapping, purposes, rights, and transfers. Build it once and Quebec Law 25 and PIPEDA obligations fall out of the same work.

Canada holds an EU adequacy decision for PIPEDA-covered commercial activity, which eases EU-to-Canada transfers — a genuine advantage over US competitors, and worth stating plainly in security reviews. Meanwhile Quebec’s Law 25 has imported GDPR-style obligations at home: if you’ve done GDPR properly, Quebec is mostly covered, and vice versa.

I fold GDPR into the same program as your security frameworks — one data map, one control set, one story your EU customers’ privacy and security teams both accept. That’s the compliance readiness engagement; if a specific EU deal is stuck on privacy review, enterprise deal support is the faster door.