In brief
GDPR compliance for a SaaS company usually takes 2–4 months to reach a defensible baseline; there is no certificate, so EU buyers check DPAs and records.
How long does GDPR compliance take? For most SaaS companies starting from scratch, reaching a defensible baseline takes 2 to 4 months; teams that already run SOC 2 or ISO 27001 often need 8 to 10 weeks. GDPR has no certificate and no audit that ends the project, so "done" means documented records, contracts and processes an EU buyer or data protection authority can check.
Is there a GDPR certificate at the end?
No. The GDPR (Regulation (EU) 2016/679) is a law, not a certification scheme, and no authority issues a "GDPR certificate" that closes the project. Article 42 allows approved certification mechanisms, but very few exist and buyers rarely ask for one. What you build is a baseline: a record of processing, a lawful basis for each activity, a privacy notice, a data subject request process, a breach procedure and signed processor agreements. The estimates below are effort estimates that depend on scope, not legal deadlines. Any timeline that ends in a "certification" step for GDPR is describing something that does not exist.
What does GDPR require of a SaaS company in practice?
GDPR applies to a company outside the EU when it offers goods or services to people in the EU or monitors their behaviour there (Article 3(2)), so a SaaS company in Hanoi with paying customers in Germany is in scope. In practice the work groups into the areas below.
| Requirement | GDPR article | What it means for a SaaS team |
|---|---|---|
| Lawful basis per activity | Art. 6 | Contract and legitimate interests cover most B2B processing; consent mainly for marketing and non-essential tracking |
| Record of processing (RoPA) | Art. 30 | Register of what data, why, how long, who receives it; organisations under 250 staff are exempt only if processing is occasional, low-risk and excludes special categories |
| Privacy notice and data subject rights | Arts. 12–22 | Answer access, deletion, correction and portability requests within one month, extendable by two further months for complex cases (Art. 12(3)) |
| Processor contracts | Art. 28 | A data processing agreement with every vendor that handles personal data for you |
| Breach notification | Art. 33 | Notify the supervisory authority within 72 hours of becoming aware of a breach that poses a risk |
| Impact assessments | Art. 35 | A DPIA before high-risk processing, such as large-scale monitoring or special-category data |
| EU representative | Art. 27 | Non-EU companies in scope of Art. 3(2) designate one in writing, unless processing is occasional and low-risk |
| Transfers outside the EU | Arts. 44–49 | Safeguards such as Standard Contractual Clauses when data leaves the EEA |
Most B2B SaaS companies do not need a Data Protection Officer: Article 37 requires one only for public bodies, large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal data.
What are the phases and how long does each take?
For a SaaS company of 20 to 100 people with a moderately complex stack, these are typical scope-dependent estimates:
| Phase | Activities | Estimate |
|---|---|---|
| Data mapping | Inventory personal data across product, dev/staging, analytics, support, marketing and HR; draft the RoPA | 3 to 5 weeks |
| Lawful basis and documentation | Assign a lawful basis per activity, write legitimate interests assessments where needed, update the privacy notice, finalise the RoPA | 2 to 3 weeks |
| Processes | Data subject request workflow, breach procedure, staff training, internal policies | 2 to 3 weeks |
| Vendors and transfers | Identify every processor, sign DPAs, build the subprocessor register, add SCCs for transfers out of the EEA | 2 to 3 weeks (then ongoing) |
| Review and testing | Test a deletion request end to end, review documents, prepare a DPA template for customers | 1 to 2 weeks |
That adds up to 10 to 16 weeks at a steady pace. Data mapping sets the real length: when engineering runs it in parallel with the legal documentation, teams compress to 8 to 10 weeks.
Why does data mapping take the longest?
Data rarely lives in one place. A SaaS product has production databases, staging environments that often hold copies of production data, analytics tools, support platforms, email tools, error tracking, chat and cloud storage, and each is a processing activity for the RoPA. Discovery is partly technical (data stores, API integrations) and partly organisational (interviews with product, engineering, sales and support), and it needs someone with the authority to get answers. Lawful basis, retention and processor agreements all depend on this inventory, so a shallow map breaks everything after it.
Where do SaaS teams usually underestimate the work?
- Non-production environments. Production data copied to dev or staging is in scope, is usually less protected and is often missing from the first map.
- The analytics stack. Session recording, product analytics, A/B testing and advertising pixels process EU personal data and usually need consent, notice and a DPA.
- Support and CRM tools. Helpdesk, live chat and CRM hold customer personal data and need DPAs, retention rules and data minimisation.
- Processor agreements at scale. Thirty tools means thirty DPAs, and every new tool needs one before it goes live.
- Untested deletion requests. One deletion can touch the product database, analytics, email, support and backups; test the flow before a real request arrives.
What does "GDPR compliant" mean when an EU prospect asks?
An EU buyer asking "are you GDPR compliant?" usually checks three things: whether you can sign a data processing agreement with Article 28 terms, a subprocessor list and a transfer mechanism; whether your privacy notice is specific and current; and whether you can answer their security questionnaire on encryption, access control, incident response and data location. It does not require a third-party audit; SOC 2 or ISO 27001 can serve as supporting evidence. See the GDPR framework page for how these pieces fit together.
What changes for a Vietnamese SaaS company?
Vietnamese companies serving EU users are fully in scope, and Vietnam has no EU adequacy decision (European Commission adequacy list), so transfers of EU data to Vietnam need safeguards, usually Standard Contractual Clauses with a transfer impact assessment. At home, Vietnam's Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP have applied since January 1, 2026, replacing Decree 13/2023. GDPR work carries over for inventory, purposes, rights handling and supplier contracts, but Vietnam adds impact-assessment filings with the Ministry of Public Security within 60 days and 6-month updates, which GDPR does not have. The Vietnam Personal Data Protection Law checklist covers those obligations.
How much work is maintenance after the first project?
GDPR is ongoing. Review the RoPA at least once a year and whenever a new processing activity starts, review the subprocessor list and DPAs yearly, run annual awareness training for staff who handle personal data, log every incident (including ones you did not notify) and every data subject request with its outcome. As a rough estimate, a typical SaaS team spends a few days per quarter on this once the baseline exists.
How does pTrackly help with the GDPR timeline?
pTrackly includes GDPR as a framework with controls, evidence tasks and policy templates tailored during onboarding. Its Privacy module keeps the record of processing activities (with lawful basis, data categories, recipients and transfer safeguards), DPIAs with an approval step, and an incident log that counts the GDPR 72-hour clock from discovery. The vendor register tracks DPA status and warns before signed DPAs expire. The legal decisions, the privacy notice wording and the request handling stay with your team and counsel. If you also need HIPAA, see HIPAA vs GDPR.
Frequently asked questions
How long does GDPR compliance take for a small SaaS company?
Usually 2 to 4 months to a defensible baseline, depending on how many systems and vendors handle personal data. Teams with existing SOC 2 or ISO 27001 documentation often finish in 8 to 10 weeks.
Is there an official GDPR certification?
No. GDPR is a regulation, not a certification scheme. Article 42 allows approved certification mechanisms, but buyers almost always check your DPA, privacy notice and security answers instead.
How fast must you answer a data subject request?
Within one month of receipt under Article 12(3). The period can be extended by two further months for complex or numerous requests, if you tell the person within the first month.
Does a non-EU SaaS company need an EU representative?
Usually yes, if GDPR applies through Article 3(2). Article 27 exempts only occasional, low-risk processing that does not involve large-scale special-category data, and public bodies.
What are the maximum GDPR fines?
Under Article 83, up to €10 million or 2% of worldwide annual turnover for obligations such as records and processor duties, and up to €20 million or 4% for breaches of the core principles, lawful basis and data subject rights, whichever is higher.
