If your SaaS product will have EU or UK users, GDPR isn't optional paperwork — it's a set of concrete product and infrastructure decisions, several of which are much cheaper to build in from the start than to retrofit after your first hundred customers. This isn't legal advice; it's the technical side of the checklist your dev team should already be working from.
Consent and cookies
- Non-essential cookies (analytics, marketing pixels) only load after explicit opt-in — not "implied by continued use."
- A visible way to withdraw consent later, not just to give it once.
- Strictly necessary cookies (session, security) are exempt from consent but should still be disclosed.
Data handling
- Data minimization. Collect what the product needs, not what might be useful someday. Every extra field you store is another thing to justify and secure.
- Right to access and deletion. Users can request their data or ask for account deletion — your system needs an actual process for this, not just a support-email workaround.
- Data residency. Know where your database and backups physically live. Some EU customers, especially in regulated industries, will ask directly.
- Sub-processors disclosed. Every third-party service that touches user data (email provider, analytics, payment processor) should be listed in your privacy policy.
Security basics regulators actually check
- Encryption in transit (TLS) and at rest for anything sensitive.
- Access controls — not every employee or admin account should be able to see every customer's data.
- A breach notification process, even if you never need it. Regulators ask whether one exists, not just whether it's been used.
What this means for your build
The cheapest time to make these decisions is during initial architecture — deciding where data lives, how consent gates analytics scripts, and how account deletion cascades through your database. Retrofitting consent-gated analytics or a real deletion flow into a live product with real customer data is a materially bigger job than building it in from the start.
Every project we scope for a EU/UK-facing product includes these as line items in the initial spec, not an afterthought — see our services page for what's covered, or read how our pricing accounts for compliance work in the initial quote.