REP27 · SaaS
Article 27 GDPR · SaaS and software
A software company crosses into the GDPR earlier than almost any other kind of business, and usually without a decision being taken. There is no shipping, no warehouse, no European office — just a signup form that starts accepting addresses in the Union. By the time an enterprise questionnaire asks for the representative, the obligation has often been running for a year.
Most SaaS companies hold both roles simultaneously, and the split matters for the record your representative keeps.
| Data | Your role | Record |
|---|---|---|
| Account holders, billing, marketing | Controller | Article 30(1) |
| End-user data your customers upload | Processor | Article 30(2) |
| Support tickets and session logs | Usually processor | Article 30(2) |
| Product analytics on your own site | Controller | Article 30(1) |
| Employee and contractor data in the EU | Controller | Article 30(1) |
European buyers are required under Article 28 to use only processors providing sufficient guarantees, so their questionnaires are not a formality. A blank field where the representative should be sends the file back to legal, and the deal slips a quarter.
Europe Services SE, Prague, with a signed designation covering the Article 27 tasks for your company.
Articles 13(1)(a) and 14(1)(a) text, generated in each language your product supports.
A certificate with a code that resolves on a public page, so a buyer can check without contacting you.
Your Article 30 record kept inside the Union and produced to an authority on request.
Physical businesses cross into the GDPR at a moment they can see: the first shipment to a European address. Software crosses at a moment nobody records, which is why the obligation is so often discovered late and retroactively.
A self-serve product has no gatekeeper. Someone in Rotterdam finds the landing page, starts a trial and begins uploading data, and the company learns about it from a dashboard weeks later, if at all. By then the processing has been continuous for a month and the occasional-processing exemption is already unavailable.
Product-led growth makes this sharper still. The strategy is designed to remove friction between discovery and use, which also removes every point at which a jurisdictional question could have been asked. Companies that would never ship a physical product into a market without checking the rules ship software there by default, several times a day.
The practical answer is not to slow the funnel. It is to treat the designation as part of launching in Europe at all — the same category as accepting euro payments or publishing a data processing agreement, done once and then forgotten.
Yes. Business contacts are personal data: names, work email addresses, job titles and phone numbers of employees at your client companies. Being B2B changes who the data subjects are, not whether the regulation applies.
Yes. Article 3(2)(a) covers offering goods or services irrespective of whether payment is required. A free trial, a freemium tier and a free API key are all services.
Where they identify users and build behavioural profiles, yes — that is Article 3(2)(b). Aggregate counts of page views without user-level identifiers sit further from the line, but most product analytics stacks are well past it.
No. Scope follows where the people are, not where the data sits. Hosting location matters for transfers, which is a separate question answered by adequacy or Standard Contractual Clauses.
Usually both, in different respects: controller for your own account holders, billing and marketing; processor for the end-user data your customers put into the product. The designation covers your company in both capacities.
The representative's name and postal address, the wording in your privacy notice, and increasingly a way to verify the designation independently. A certificate with a public code answers all three without an email thread.
Within 24 hours of a completed onboarding form. The privacy notice wording comes with it, so the public part of the questionnaire can be answered the same day.
Designation and certificate within 24 hours, with wording ready to paste into your notice.
See pricing Run the free check