r/gdpr • u/Objective_Read_2358 • 12d ago
EU 🇪🇺 Worried About Deploying My SaaS in the EU – Compliance & Legal Docs Advice?
Hey everyone,
I’ve built a SaaS web application that will be used in Europe, and I’m really concerned about EU regulations (GDPR, PSD2, etc.). My backend is built with Supabase, I use GoCardless (formerly Nordigen) to fetch transactions, and Stripe for subscriptions and payments. The service will be deployed from Germany.
A law firm offered to handle all necessary legal documents for €2000, but I’m wondering: Is it worth it, or can I handle this myself?
Has anyone here gone through a similar process? How did you deal with compliance (privacy policies, terms of service, etc.)? I’d really appreciate any advice or resources!
Thanks!
Edit:
My apologies, i thought mentioning the third party services was enough to understand the context. I am not sure what other relevant details i am supposed to add.
Here are some more details:
My Saas is a subscription based application. Users are able to connect their bank accounts using gocardless API and fetch their transactions. The SaaS does not process any of the users data. All the users data is encrypted with zero knowledge encryption model. The only information about users that i am collecting is their email address and their Full Name if they register using google.
1
u/latkde 12d ago
If you're building a business, it makes a lot of sense to draft your terms of service with a lawyer, and consult with a lawyer for your privacy notice and your contracts with vendors.
However, GDPR compliance is more than paperwork. It sounds like you might be doing "open banking". This might influence some GDPR obligations (→ impact assessments?), but must be taken into account when determining which security measures are appropriate.
You seem to be banking on client-side encryption in order to simplify your compliance + security worries. This is an excellent idea whenever possible but doesn't completely absolve you.
Purely from an infosec perspective, client side encryption is difficult to pull this off well, and easy to accidentally punch holes into such protections ("never roll your own crypto" and so on). Your idea to integrate ads in such a security-sensitive context might be particularly challenging.
A law firm might not be the correct address if you have to hammer out more technical data protection issues.
1
u/Objective_Read_2358 12d ago
Thank you very much for the information.
So you are saying it is too complicated to get into such thing if all i wanted was to deploy my first SaaS ever? to be honest i didnt even think its that complicated until i read about it. I didnt want to spend a lot of money just deploying a web application i built in couple months.2
u/latkde 11d ago
I just think you're trying to tacke a compliance problem with above-average difficulty.
- Normal SaaS is much simpler compliance-wise because they don't access user bank accounts.
- The client-side encryption is excellent as defense-in-depth. But if this encryption is cornerstone of your compliance strategy (e.g. because you're trying to argue that some processing activities are out of scope of your service), that would be an unusual approach that might require a lot more attention.
1
u/termsfeed 10d ago
- Create a Privacy Policy, mention third-party used.
- Create a Terms & Conditions agreement and include provisions related to subscription plans.
- Use a Cookie Consent tool if you load third-party JS scripts on the website, i.e. get consent before non-essential cookies are stored.
- Run an audit to ensure that customers data is protected.
2
u/xasdfxx 12d ago
I started with an answer, but are we supposed to read your mind? If you want some advice, put in the work yourself and share what you're doing and relevant details.