# GDPR Checklist for Solo SaaS Founders (2026)

> A 12-step GDPR checklist for solo SaaS founders: scope, data map, lawful basis, privacy notice, vendor DPAs, user rights, breaches, EU rep, UK fee and cookies.

- Canonical: https://zeroraised.com/blog/gdpr-checklist-for-solo-saas-founders
- Published: 2026-11-07T15:30:00Z
- Author: ZeroRaised Team (https://zeroraised.com/blog/authors/zeroraised)
- Publisher: ZeroRaised (https://zeroraised.com/)
- Section: Building
- Tags: legal, saas, checklist, solo-founders

**Short answer:** If people in the EU can sign up for your SaaS, GDPR probably applies to you, even if you live outside the EU and work alone. For a solo founder, compliance is a short list of one-off jobs: map your data, pick a lawful basis for each use, publish a privacy notice, accept your vendors' data processing agreements, and have a plan for user requests and breaches. Work through the 12 steps below in order and you will cover the parts that matter most.

## TL;DR

- **Scope:** Art. 3(2) covers non-EU businesses "offering of goods or services" to people in the EU, paid or free ([Art. 3](https://gdpr-info.eu/art-3-gdpr/)).
- **Paperwork you need:** a data map, a privacy notice, signed or accepted DPAs with every vendor that touches user data, and a one-page record of processing.
- **Deadlines:** one month to answer a rights request ([Art. 12](https://gdpr-info.eu/art-12-gdpr/)), 72 hours to report a qualifying breach ([Art. 33](https://gdpr-info.eu/art-33-gdpr/)).
- **Costs that may apply:** an EU representative if you have no EU establishment (DataRep from €150 a year), and the UK ICO fee (£52 for tier 1) if you are a UK business.
- **Cheap wins:** cookie-free analytics, no marketing pixels in the app, and a privacy inbox you actually check.

**Disclosure:** ZeroRaised publishes this guide and is a launch site for bootstrapped products. We have no commercial relationship with any vendor named here. This is not legal advice. Article text and prices come from the linked sources, checked on 7 Nov 2026. If you process health, financial or children's data, talk to a privacy lawyer.

## Before you start: what this checklist covers

This post covers the EU GDPR and UK GDPR for a one-person SaaS handling ordinary personal data: names, emails, billing details, IP addresses and product usage. Terms of service, and privacy policy generator prices, are in [how to write terms of service for a SaaS](https://zeroraised.com/blog/how-to-write-terms-of-service-for-a-saas).

For your users' account data you are the **controller**. Your vendors (hosting, database, email, payments) are **processors** acting for you. If customers upload their own customers' data into your app, you are their processor too, and they will ask you for a DPA.

## The 12-step GDPR checklist

| # | Step | Article | Time for a solo founder |
|---|---|---|---|
| 1 | Confirm GDPR applies | Art. 3(2) | 10 minutes |
| 2 | Map your data | Art. 30 (basis for it) | 1 hour |
| 3 | Pick a lawful basis per purpose | Art. 6 | 30 minutes |
| 4 | Publish a privacy notice | Art. 13 | 2 hours |
| 5 | Accept vendor DPAs | Art. 28 | 1 hour |
| 6 | Check international transfers | Chapter V | 20 minutes |
| 7 | Write your record of processing | Art. 30 | 1 hour |
| 8 | Set up a rights request process | Art. 12, 15-22 | 1 hour |
| 9 | Write a breach plan | Art. 33-34 | 1 hour |
| 10 | Decide on an EU representative | Art. 27 | 30 minutes |
| 11 | UK: pay the ICO fee | UK law | 15 minutes |
| 12 | Fix cookies and analytics | ePrivacy Art. 5(3) | 1-2 hours |

The time estimates are ours, for a simple SaaS with a handful of vendors.

### 1. Confirm GDPR applies to you

Article 3(2) extends GDPR to a controller or processor with no EU establishment when the processing relates to "the offering of goods or services, irrespective of whether a payment of the data subject is required", or to "the monitoring of their behaviour as far as their behaviour takes place within the Union" ([Art. 3](https://gdpr-info.eu/art-3-gdpr/)).

Our read: a stray EU visitor alone does not trigger GDPR, but euro pricing, EU languages and accepting EU signups signal that you are offering services there. Behavioural analytics on EU visitors can count as monitoring. If you sell worldwide, assume GDPR applies.

### 2. Map your data

Make a spreadsheet with one row per type of data: what it is, why you hold it, which vendor stores it, who can see it, and when you delete it. For example:

| Data | Purpose | Stored in | Kept for (example) |
|---|---|---|---|
| Name, email, password hash | Run the account | Supabase | Life of account + 30 days |
| Billing details | Take payment | Stripe | Per Stripe and tax rules |
| Transactional email logs | Send receipts, resets | Resend | Vendor default |
| IP address, server logs | Security, debugging | Vercel / Cloudflare | Short, per vendor |
| Product events | Improve the product | Analytics tool | 12 months |
| Support emails | Answer questions | Help desk or inbox | 2 years |

The retention periods are illustrative, so set your own. Every later step builds on this sheet.

### 3. Pick a lawful basis for each purpose

Article 6(1) says "Processing shall be lawful only if and to the extent that at least one of the following applies" and then lists six bases ([Art. 6](https://gdpr-info.eu/art-6-gdpr/)). A SaaS mostly uses three:

- **Contract (6(1)(b)):** what you need to deliver the service: the account, billing, service emails.
- **Legitimate interests (6(1)(f)):** security logs, fraud prevention, basic product analytics, unless the user's rights override your interest. Write a short balancing note for each.
- **Consent (6(1)(a)):** marketing to non-customers, non-essential cookies, anything a user would be surprised by.

Legal obligation (6(1)(c)) covers keeping invoices for tax. Add a basis column to your data map.

### 4. Publish a privacy notice

Article 13 requires you to give users certain information "at the time when personal data are obtained" ([Art. 13](https://gdpr-info.eu/art-13-gdpr/)). That means at signup, so link the notice from the signup form. Cover at least: who you are and how to reach you (plus any EU representative), each purpose and its lawful basis, the legitimate interests you rely on, your vendor list, transfers outside the EU and their safeguard, retention periods, user rights, and the right to complain to a regulator. A generator can draft it, but edit the draft against your data map so it describes what your app actually does.

### 5. Accept a DPA with every processor

Article 28 says "the controller shall use only processors providing sufficient guarantees", and "Processing by a processor shall be governed by a contract or other legal act" ([Art. 28](https://gdpr-info.eu/art-28-gdpr/)). That contract is the DPA. The good news is that most indie-friendly vendors build it into their terms:

| Vendor | DPA page | How it applies | Transfer mechanism named |
|---|---|---|---|
| Stripe | [stripe.com/legal/dpa](https://stripe.com/legal/dpa) | Incorporated by reference into the agreement | Data Privacy Framework and EEA SCCs |
| Vercel | [vercel.com/legal/dpa](https://vercel.com/legal/dpa) | Binding on entering the agreement; covers Pro and Enterprise plans | 2021 SCCs |
| Supabase | [supabase.com/legal/dpa](https://supabase.com/legal/dpa) | Part of the terms; acceptance has "the same effect as signing the SCCs" | 2021 SCCs |
| Resend | [resend.com/legal/dpa](https://resend.com/legal/dpa) | Binding on entering the agreement | EU-U.S. DPF and EU SCCs |
| Plausible | [plausible.io/dpa](https://plausible.io/dpa) | "No separate signature is required" | Data hosted in the EU |
| Cloudflare | [Cloudflare DPA](https://www.cloudflare.com/cloudflare-customer-dpa/) | Part of the main agreement once agreed or signed | DPF and 2021 SCCs |

One catch: Vercel's DPA covers Pro and Enterprise, so serving paying EU customers from Hobby leaves a gap. Save a dated PDF of each DPA. When a B2B customer asks for your sub-processor list, send this table.

### 6. Check international transfers

Sending EU data to a US vendor is a "transfer" and needs a safeguard. As of 7 Nov 2026 there are two in common use:

- **EU-U.S. Data Privacy Framework (DPF).** The Commission says that under its July 2023 adequacy decision, "personal data can flow freely from the EU to companies in the United States that participate in the Data Privacy Framework" ([European Commission](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en)). The EU General Court upheld the decision in *Latombe v Commission* (T-553/23) on 3 September 2025, and the challenger has appealed to the Court of Justice ([WilmerHale](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework)). We found no reported judgment on the appeal as of today.
- **Standard Contractual Clauses (SCCs).** These are the 2021 Commission clauses that most vendor DPAs above include anyway.

Our read: prefer vendors whose DPA includes SCCs as well as the DPF, so nothing breaks if the court rules against the framework. For UK data, the ICO notes that the "UK's adequacy regulations for the US are independent of the EU's adequacy finding for the US" ([ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/)).

### 7. Write your record of processing (Art. 30)

Article 30 exempts organisations with "fewer than 250 persons unless the processing it carries out is likely to result in a risk", and the exemption also lapses if processing is not occasional or includes special category data ([Art. 30](https://gdpr-info.eu/art-30-gdpr/)). A SaaS processes user data continuously, so do not lean on it. Your data map, basis column, vendor list and a line on security measures is the record. Date it and update it when you add a vendor.

### 8. Set up a rights request process

Users can ask to access, correct, delete or export their data, or object to processing (Articles 15 to 22). You must respond "without undue delay and in any event within one month of receipt of the request", and "That period may be extended by two further months where necessary" for complex or numerous requests ([Art. 12](https://gdpr-info.eu/art-12-gdpr/)).

For a solo founder:

1. Add a privacy@ alias and list it in the privacy notice.
2. Build a "delete my account" button that also deletes the user at vendors via their APIs (Stripe customer, email contact).
3. Keep an admin script that exports one user's data as JSON, which covers access and portability.
4. Log each request with the dates received and answered.

### 9. Write a breach plan

If personal data leaks, Article 33 requires notifying your lead regulator "not later than 72 hours after having become aware of it", unless the breach is unlikely to put people at risk ([Art. 33](https://gdpr-info.eu/art-33-gdpr/)). If the breach is "likely to result in a high risk to the rights and freedoms of natural persons", you also tell affected users without undue delay ([Art. 34](https://gdpr-info.eu/art-34-gdpr/)).

Write a half-page plan now, while you are calm: how you would rotate keys, which regulator you would notify, a template email to users, and an incident log that includes breaches you decide not to report. Our [launch checklist](https://zeroraised.com/blog/product-launch-checklist-for-bootstrapped-makers) covers access and account hygiene before you go live.

The top tier of fines reaches "up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover", whichever is higher ([Art. 83](https://gdpr-info.eu/art-83-gdpr/)).

### 10. Decide on an EU representative (Art. 27)

If GDPR applies to you through Article 3(2), the controller "shall designate in writing a representative in the Union" ([Art. 27](https://gdpr-info.eu/art-27-gdpr/)). The exemption is narrow: processing that is occasional, does not include large-scale special category data and is unlikely to create risk. A SaaS with ongoing EU accounts usually fails "occasional".

Published prices checked today:

| Service | Entry price | Notes |
|---|---|---|
| [DataRep](https://www.datarep.com/shop/) | €150 to €250 per year | Small company package, up to 1,000 data subjects; Basic package €400 to €600 for up to 10,000 |
| [Prighter](https://prighter.com/pricing/) | Monthly tiers per product, excl. VAT | Bundle discount of 10% per additional product, up to 40% |

Put the representative's contact details in your privacy notice, as Art. 13 requires.

### 11. UK founders: pay the ICO data protection fee

If you are a UK business, the ICO says organisations, sole traders included, must pay "a data protection fee, unless they are exempt" ([ICO](https://ico.org.uk/for-organisations/data-protection-fee/)). Current amounts ([ICO FAQ](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/)):

| Tier | Who | Fee |
|---|---|---|
| Tier 1 | Turnover up to £632,000 or no more than 10 staff | £52 |
| Tier 2 | Turnover up to £36 million or no more than 250 staff | £78 |
| Tier 3 | Everyone else | £3,763 |

"The cost is reduced by £5 if you pay by direct debit", so tier 1 is £47 a year. The ICO's [self-assessment](https://ico.org.uk/for-organisations/data-protection-fee/self-assessment/) takes about 10 minutes. The ICO also notes that, because of the Data (Use and Access) Act, its fee guidance is under review, so check it again when you renew.

### 12. Fix cookies and analytics

Cookies fall under the ePrivacy Directive, not just GDPR. Article 5(3) says storing or accessing information on a user's device "is only allowed on condition that the subscriber or user concerned has given his or her consent", with exceptions for what is strictly necessary to provide a service the user explicitly asked for ([ePrivacy Directive](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219)).

In practice:

- **No banner needed:** login session cookies, CSRF tokens, a cookie that remembers a consent choice.
- **Consent needed:** ad pixels, retargeting, and most third-party analytics that set identifiers.
- **Cheapest route:** use cookie-free analytics on the marketing site. Plausible says "No cookie banner required" and "No cookies, no persistent identifiers" ([Plausible](https://plausible.io/)). Umami has a free Hobby plan with "Up to 100K events per month" for one website ([Umami](https://umami.is/pricing)). We compare the two most common setups in [PostHog vs Plausible for indie makers](https://zeroraised.com/blog/posthog-vs-plausible-for-indie-makers).
- **If you need a banner:** CookieYes has a free plan for 5,000 pageviews a month and a Basic plan at $10/mo, or $100 a year, per domain ([CookieYes](https://www.cookieyes.com/pricing/)). Make "Reject" as easy as "Accept", and do not load the tags until consent is given.

## Worked example: a one-person SaaS in Canada

Illustrative: Maya runs an invoicing SaaS from Toronto on Vercel Pro, Supabase, Stripe and Resend, with euro pricing and about 300 EU customers.

1. GDPR applies through Art. 3(2): she offers a service to EU users in euros.
2. Her data map has 9 rows, mostly on contract and legitimate interests.
3. All four DPAs apply through her accepted terms, and she saves PDFs. Stripe and Resend name the DPF and SCCs, while Vercel and Supabase name SCCs.
4. She appoints an EU representative: DataRep's small company package lists at €150 to €250 a year.
5. She swaps a Google Analytics tag for cookie-free analytics and drops her cookie banner.

Total: about a day of work plus €150 to €250 a year. Our read: that is cheap for answering a B2B buyer's security questionnaire with confidence.

## Frequently asked questions

### Does GDPR apply to my SaaS if I am not in the EU?

It can. Article 3(2) extends GDPR to controllers outside the EU when processing relates to offering goods or services to people in the EU, whether or not they pay, or to monitoring their behaviour in the EU. If you market to EU users, accept EU signups and charge in euros, assume it applies.

### Do I need a cookie banner for my SaaS?

Only for non-essential cookies or similar storage. ePrivacy requires consent before storing or reading information on a device, except where strictly necessary for a service the user asked for. Login session cookies are usually fine. Ad pixels and most third-party analytics are not. Plausible says its cookie-free analytics needs no banner.

### Do I need a record of processing activities as a one-person company?

Article 30 waives the record for organisations under 250 people, unless the processing is risky, not occasional, or includes special category or criminal data. A SaaS processes customer data constantly, so 'occasional' is a hard argument. A one-page record takes an hour, so keep one.

### Do I need an EU representative?

If you have no establishment in the EU and GDPR applies to you through Article 3(2), Article 27 says you must designate one in writing. There is a narrow exemption for occasional, low-risk processing that excludes large-scale special category data. EU representative services publish prices: DataRep starts at €150 a year for small companies, and Prighter lists monthly plans on its pricing page.

### Can I still use US vendors after the Latombe ruling?

Yes, as of 7 Nov 2026. The EU-U.S. Data Privacy Framework adequacy decision was adopted in July 2023, the EU General Court upheld it in Latombe v Commission in September 2025, and an appeal to the Court of Justice is pending. Stripe, Resend and Cloudflare name both the framework and Standard Contractual Clauses in their DPAs, so there is a fallback.

## Ship it, then launch it

Once your privacy notice is live and your DPAs are filed, you are ready for strangers to sign up. [Submit your product to ZeroRaised](https://zeroraised.com/submit) to launch it in front of other bootstrapped makers, and [join the newsletter](https://zeroraised.com/newsletter) for more practical guides on building without investors.

## Sources

- [GDPR Art. 3, territorial scope](https://gdpr-info.eu/art-3-gdpr/), last checked 7 Nov 2026
- [GDPR Art. 6, lawfulness of processing](https://gdpr-info.eu/art-6-gdpr/), last checked 7 Nov 2026
- [GDPR Art. 12, transparent information and modalities](https://gdpr-info.eu/art-12-gdpr/), last checked 7 Nov 2026
- [GDPR Art. 13, information to be provided](https://gdpr-info.eu/art-13-gdpr/), last checked 7 Nov 2026
- [GDPR Art. 27, representatives](https://gdpr-info.eu/art-27-gdpr/), last checked 7 Nov 2026
- [GDPR Art. 28, processor](https://gdpr-info.eu/art-28-gdpr/), last checked 7 Nov 2026
- [GDPR Art. 30, records of processing activities](https://gdpr-info.eu/art-30-gdpr/), last checked 7 Nov 2026
- [GDPR Art. 33, breach notification to the authority](https://gdpr-info.eu/art-33-gdpr/), last checked 7 Nov 2026
- [GDPR Art. 34, communication of a breach to the data subject](https://gdpr-info.eu/art-34-gdpr/), last checked 7 Nov 2026
- [GDPR Art. 83, fines](https://gdpr-info.eu/art-83-gdpr/), last checked 7 Nov 2026
- [ePrivacy Directive 2002/58/EC, consolidated text](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219), last checked 7 Nov 2026
- [European Commission, EU-US data transfers](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en), last checked 7 Nov 2026
- [WilmerHale, Court of Justice to review DPF challenge](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework), last checked 7 Nov 2026
- [ICO, adequacy regulations](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/), last checked 7 Nov 2026
- [ICO, data protection fee](https://ico.org.uk/for-organisations/data-protection-fee/), last checked 7 Nov 2026
- [ICO, data protection fee FAQs](https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/), last checked 7 Nov 2026
- [ICO, data protection fee self-assessment](https://ico.org.uk/for-organisations/data-protection-fee/self-assessment/), last checked 7 Nov 2026
- [Stripe DPA](https://stripe.com/legal/dpa), last checked 7 Nov 2026
- [Vercel DPA](https://vercel.com/legal/dpa), last checked 7 Nov 2026
- [Supabase DPA](https://supabase.com/legal/dpa), last checked 7 Nov 2026
- [Resend DPA](https://resend.com/legal/dpa), last checked 7 Nov 2026
- [Plausible DPA](https://plausible.io/dpa), last checked 7 Nov 2026
- [Cloudflare customer DPA](https://www.cloudflare.com/cloudflare-customer-dpa/), last checked 7 Nov 2026
- [DataRep shop](https://www.datarep.com/shop/), last checked 7 Nov 2026
- [Prighter pricing](https://prighter.com/pricing/), last checked 7 Nov 2026
- [CookieYes pricing](https://www.cookieyes.com/pricing/), last checked 7 Nov 2026
- [Plausible homepage](https://plausible.io/), last checked 7 Nov 2026
- [Umami pricing](https://umami.is/pricing), last checked 7 Nov 2026

## Frequently asked questions

### Does GDPR apply to my SaaS if I am not in the EU?

It can. Article 3(2) extends GDPR to controllers outside the EU when processing relates to offering goods or services to people in the EU, whether or not they pay, or to monitoring their behaviour in the EU. If you market to EU users, accept EU signups and charge in euros, assume it applies.

### Do I need a cookie banner for my SaaS?

Only for non-essential cookies or similar storage. ePrivacy requires consent before storing or reading information on a device, except where strictly necessary for a service the user asked for. Login session cookies are usually fine. Ad pixels and most third-party analytics are not. Plausible says its cookie-free analytics needs no banner.

### Do I need a record of processing activities as a one-person company?

Article 30 waives the record for organisations under 250 people, unless the processing is risky, not occasional, or includes special category or criminal data. A SaaS processes customer data constantly, so 'occasional' is a hard argument. A one-page record takes an hour, so keep one.

### Do I need an EU representative?

If you have no establishment in the EU and GDPR applies to you through Article 3(2), Article 27 says you must designate one in writing. There is a narrow exemption for occasional, low-risk processing that excludes large-scale special category data. EU representative services publish prices: DataRep starts at €150 a year for small companies, and Prighter lists monthly plans on its pricing page.

### Can I still use US vendors after the Latombe ruling?

Yes, as of 7 Nov 2026. The EU-U.S. Data Privacy Framework adequacy decision was adopted in July 2023, the EU General Court upheld it in Latombe v Commission in September 2025, and an appeal to the Court of Justice is pending. Stripe, Resend and Cloudflare name both the framework and Standard Contractual Clauses in their DPAs, so there is a fallback.