A SaaS founder in Bangalore got an email from a customer in Germany: "Our legal team reviewed your GDPR compliance documentation. We need updated Data Processing Agreement before next quarter."

His response? He had no documentation. No DPA. No idea what they were asking for. He Googled "GDPR checklist," found 47 different ones, got overwhelmed, and shelved it for 6 months.

Then a customer in the EU requested their data and he had no process to extract it in 30 days. That's a GDPR violation. ₹20 lakh fine.

GDPR compliance isn't optional if you have even one EU customer. And it's not as complicated as it looks.

GDPR 101: What It Actually Means

GDPR (General Data Protection Regulation) is an EU law that says:

• If you collect data from EU residents, you follow EU rules. Doesn't matter if your company is in India or the US.
• Users have rights: Right to know what data you have, right to delete it, right to correct it, right to download it.
• You're accountable: You need documented proof that you're following these rules.
• Fines are real: Up to €20M or 4% of global revenue — whichever is larger.

But here's what most vendors don't tell you: You don't need to be "100% GDPR compliant." You need to be "compliant enough that regulators don't fine you" + "compliant enough that your enterprise customers trust you."

The 6-Week GDPR Compliance Sprint

Week 1: Audit What Data You Have

Action Items:

• List every place customer data lives (databases, backups, logs, third-party services, CDNs, analytics)
• For each, answer: What data? How long do we keep it? Who has access?
• Example: "Stripe payments database → email, name, last 4 digits of card → 7 years → accessed by 3 people"

Tools: Spreadsheet (seriously, no tool needed yet)

Output: Data inventory (looks like a Google Sheet with columns: Data Type | Location | Retention | Access | Risk Level)

Week 2: Identify Risks & Fix Easy Ones

Common GDPR Violations to Fix Now:

• 📋 Backups with no deletion date: If you back up customer data forever, you can't satisfy deletion requests. Fix: Set retention policy (30 days for cold backups is reasonable)
• 📋 No encryption: EU customers expect data encrypted in transit (HTTPS ✓) and at rest. Fix: Enable database encryption, encrypted backups
• 📋 Third-party access with no contract: If you use AWS, Stripe, or any vendor, you need a Data Processing Agreement. Fix: Find their DPA template and sign it
• 📋 No process for data deletion: User requests deletion → engineer manually deletes → done? That's not compliant. You need a formal documented process. Fix: Write a runbook
• 📋 Personal data in logs: Your app logs contain customer emails/IPs? That's personal data and must be encrypted/deleted. Fix: Redact logs or shorten retention

Time to fix: 5-10 hours. Most of these are process changes, not engineering work.

Week 3: Write Your Privacy Policy & Privacy Documentation

Minimum privacy documentation:

1. Privacy Policy (Public-facing, on your website)

• What data do you collect?
• Why do you collect it?
• How long do you keep it?
• Who do you share it with?
• User rights (data access, deletion, portability, etc.)
• How do users exercise these rights? (Email? Form? API?)

Don't copy boilerplate. Write one specific to your business. Template: "We collect email and usage data to provide the service and improve it. We keep it for 2 years after account deletion. We share it with Stripe and Intercom only. Users can request deletion at privacy@yoursite.com."

2. Data Processing Agreement (DPA)

This is a legal document between you (data controller) and your customer (processor of their customers' data). Every enterprise customer will ask for it. Templates exist — we help companies get these done.

Covers: What data? Why? How long? What security? What happens if there's a breach?

3. Sub-processor List

List all third parties who can access customer data: Stripe, Sendgrid, AWS, Datadog, etc. Customers need to know.

Time to write: 4-8 hours (or hire a lawyer for ₹2-5 lakhs)

Week 4: Data Export & Deletion Functionality

Build two features:

1. Data Export (Right to Portability)

Users can request their data in a standard format (CSV/JSON). You have 30 days. For most SaaS: Extract from DB → zip → email. Could be a 1-day engineering task.

2. Account Deletion (Right to be Forgotten)

User requests deletion → everything about them deleted from all systems within 30 days. This is tricky: Delete from main DB (easy), but what about: Backups? Logs? Analytics? Stripe? Datadog?

Common approach: Soft delete in app (hide data) + async job that hard-deletes after 90 days (accounting/fraud prevention purposes).

Time: 3-5 engineering days

Week 5: DPA Signatures & Vendor Audit

Get DPAs signed with every vendor who touches customer data:

• Stripe / payment processor
• Email service (SendGrid, Mailgun, Intercom)
• Analytics (Mixpanel, Amplitude, Google Analytics)
• CDN (Cloudflare, Akamai)
• Cloud provider (AWS, GCP, Azure)

Most vendors have DPAs ready — just sign them. Takes 5 min each. If they don't have one, that's a red flag. Switch vendors or negotiate.

Time: 2 hours

Week 6: Documentation & Testing

Create this documentation (for regulators & customers):

• ☐ Privacy Policy (public on website)
• ☐ Data inventory (what, where, how long, who)
• ☐ Data Processing Agreement (use Intercom's template)
• ☐ Sub-processor list (all third parties)
• ☐ Deletion procedure runbook (step-by-step how we delete data)
• ☐ Breach response plan (if hacked, what do we do?)
• ☐ Vendor audit checklist (each vendor's DPA status)

Test data rights: Submit a fake data export request to yourself. Can you do it in 30 days? Submit a deletion request. Does the user disappear from your app + database?

Time: 4-6 hours

GDPR Compliance Cost Breakdown

Common GDPR Mistakes That Cost Money

❌ Mistake #1: Assuming you don't need GDPR if your company is outside EU
You DO if you have any EU customers. Regulators don't care where you're incorporated.

❌ Mistake #2: Not having a data deletion process
User asks to delete their account. You delete from app but not backups. That's a violation. Fined ₹10-20 lakhs.

❌ Mistake #3: Using vendors without DPAs
You're liable for your vendors. If your email service doesn't have a DPA, it's your breach risk.

❌ Mistake #4: Storing personal data longer than needed
EU law: Don't keep data longer than necessary. "Necessary" is usually: As long as the account is active + 1-2 years after deletion.

❌ Mistake #5: Not encrypting sensitive data
Email addresses, phone numbers, payment info must be encrypted at rest. Logs must be encrypted or rotated. No excuses.

GDPR Checklist (Copy & Use This)

FAQ: GDPR Compliance

Next Steps

If you have EU customers, this is urgent. Start Week 1 this week. If you're pre-revenue but planning to sell to EU, do this before launching.

Book a 30-min GDPR assessment with our compliance team. We'll identify what you're doing well and what needs fixing. Most companies need 3-6 weeks, not months.

— Shreyas
GDPR isn't a checkbox. It's table stakes for selling in Europe. We help dozens of SaaS companies get compliant without the legal bill shock.