Start a project
Start a project Book a call
Compliance

Building a SaaS product for US and EU customers: GDPR, contracts and security evidence from day one

What US, Canadian, UK and EU business buyers ask a new software vendor, and a build-it-in-early checklist and stage plan for contracts and security evidence.

ESTASOFT
11 min read
Sand coloured cover with three stacked bars in black, gold and white, with the title SaaS for US and EU customers
On this page
    On this page

      Your first mid-size customer wants to sign. Then three documents arrive: a security questionnaire, a data processing agreement and a request for your list of subprocessors. If nothing is ready, the deal waits. This article covers what business buyers in the US, Canada, the UK and the EU may ask a new software vendor, the privacy roles and contract terms behind those questions, what SOC 2 and ISO/IEC 27001 are, and what to build early so your answers are true.

      I read the official pages on 5 November 2026. Guidance changes, so treat this as a map, not legal advice.

      What buyers may ask a new software vendor

      The Cloud Security Alliance publishes a questionnaire called the CAIQ. Its page shows version 4.1, released 27 January 2026. It is a set of yes or no questions about a cloud provider's security controls, which the CSA says cloud customers and auditors use. A 2022 CSA post says it has 17 domains, including identity and access management and data security and privacy. Your buyer may use another form.

      Prepare written answers to these before anyone asks:

      • Are you the controller or the processor, and is a data processing agreement ready?
      • Which subprocessors do you use, what data do they see and where are they?
      • Where is the data stored, and who can reach it from which countries, for example support staff?
      • How would you find out about a breach, and how fast would you tell customers?
      • How is data backed up, and how is it deleted when a customer leaves?
      • How is access controlled: roles, staff sign-in, single sign-on for customer users, audit logs?
      • Do you hold a SOC 2 report or an ISO/IEC 27001 certificate, and if not, what else can you show?

      Controller or processor: which are you

      The European Data Protection Board (EDPB) says a controller decides why and how personal data is processed. A processor handles the data under the controller's instructions only. A sub-processor works under the processor's instructions.

      In a typical business product, your customers decide what data goes in and you process it for them. That points to processor for that data, and to controller for your own billing, marketing and website data. The ICO warns that a processor which acts outside instructions or uses the data for its own purposes becomes a controller for that processing. So ask your adviser before you use customer data for product analytics or to train a model.

      The European Commission says the GDPR applies to a company outside the EU that offers goods or services to people in the EU or monitors their behaviour there, but not to one that does not target them. Whether your product counts as targeting is a question for an adviser. The UK has its own version of the rules, and the ICO says its contract guidance is under review because the Data (Use and Access) Act became law on 19 June 2025.

      What a data processing agreement covers

      The ICO and the EDPB's small business guide list similar terms. A processor contract should set out the subject, duration, purpose and nature of the processing, the type of data and the people it covers. It should also bind you to these:

      • Process only on the customer's documented instructions, including for transfers.
      • Keep everyone with access bound by confidentiality.
      • Apply appropriate security. The ICO gives encryption, pseudonymisation and regular testing as examples.
      • Use no subprocessor without the customer's written authorisation. Under a general authorisation you tell them about changes and let them object. You pass the same data protection terms down and stay liable.
      • Help with rights requests such as access, correction and erasure.
      • Help with security, breach notification and impact assessments.
      • At the end, delete or return all data as the customer chooses. The ICO allows backups to stay temporarily if they are put beyond use and deleted as soon as practical.
      • Provide information that shows compliance, and allow and contribute to audits.

      The ICO adds that clauses from the Danish authority, approved by the EDPB, should meet the Article 28 requirements if used unamended. Ask your adviser whether to offer your own paper or accept the buyer's.

      Two terms drive product design. First, the EDPB's Opinion 22/2024, adopted on 7 October 2024, says information on all processors and sub-processors should be readily available. A processor should proactively give names, addresses, contacts and a description of each one's processing, and keep it current. The controller should also map transfers, including remote access, and know where sub-processors are. Second, a processor must tell the controller about a breach without undue delay, and the EDPB guide says a controller notifies its authority within 72 hours of becoming aware, where notification is required. That guide covers the EU rule, so ask your adviser how UK and Canadian notice rules compare. Your delay uses up part of the customer's window, so ask what notice period each buyer wants.

      SOC 2 and ISO/IEC 27001: what they are and are not

      • SOC 2. The AICPA, the American Institute of CPAs, describes a SOC 2 examination as a check of a service organisation's system description and controls against these categories: security, availability, processing integrity, confidentiality and privacy. Its guide is written for CPAs in public practice who are engaged to perform these examinations. The AICPA says customers and business partners often ask service organisations for SOC 2 reports. The pages I opened do not explain Type 1 versus Type 2, so ask an auditor what each means and which your buyer expects.
      • ISO/IEC 27001. ISO names it as the standard that sets requirements for an information security management system. An ISO news page says organisations can be certified to it and that certification is optional. ISO's 2026 SC 27 journal says independent certification bodies issue the certificates after an audit. I could not open ISO's own page for 27001, so check ISO for the current edition.

      None of the pages I read says either is a legal requirement. A buyer can still put one in a contract or a procurement checklist.

      US and Canadian privacy rules in brief

      • United States. Privacy rules differ by state, and I opened only California's. The California Attorney General page, updated 28 August 2026, says the CCPA covers for-profit businesses that do business in California and meet one of three tests: gross annual revenue over $25 million, buying, selling or sharing the personal information of 100,000 or more residents or households, or earning half or more of revenue from selling residents' information. An undated California Privacy Protection Agency document gives $26,625,000 for the revenue test. Neither page says why the two figures differ or whether the threshold changes over time, so confirm the current figure with the agency or counsel. The AG page says the business, not its service provider, answers consumer requests. Ask counsel which other states your customers are in.
      • Canada. The Office of the Privacy Commissioner says PIPEDA covers private-sector organisations that collect, use or disclose personal information in commercial activity, and that Alberta, British Columbia and Quebec have their own laws deemed substantially similar. Its accountability page (last modified 13 August 2020) says an organisation stays responsible for information it gives a third party to process, including outside Canada, and should use a contract or other means to secure comparable protection and limit the provider's use. It should also tell people their data may be processed in another jurisdiction. Canadian buyers may therefore ask about contract terms and processing locations.

      Build it in early: a checklist

      This is where product engineering choices turn into contract answers.

      • Tenant data separation. Give every record a customer account ID from the first table, so you can export and delete one customer's data without touching another's.
      • Deletion and export. Build both per customer and per person. Decide how long backups live and how deletion reaches them.
      • Logging. Record who accessed or changed what, and keep logs safe from edits. The EDPB guide also says to record every breach, including ones you do not report.
      • Access control. Use roles and least access for your own staff, and decide whether customers can sign in through their own identity provider.
      • Encryption and key management. Keep keys apart from the data. The EDPB guide lists encryption, with the keys not compromised, as one condition under which individuals may not need to be told of a breach.
      • Vendor register. List every subprocessor with the data it sees, its location and its purpose. Review it before adding a vendor and warn customers of changes.
      • Data location map. Include backups, support tools and staff remote access, not only the main database. Our article on hosting location and data transfers goes deeper.
      • Incident runbook. Name who decides, who tells customers and what the notice says.
      • Own-use rule. Write down whether you use customer data beyond the service, and keep to it.
      • Regular testing. Plan security testing. A security review is one way.

      A stage plan

      Prototype

      • Use made-up data, not real customer data.
      • Keep the customer account ID in the data model from the start.
      • List the services you use, choose a hosting region and note what personal data you expect to hold.

      First customers

      • Agree a data processing agreement, and publish your privacy notice and subprocessor list.
      • Test a restore from backup and a customer deletion.
      • Turn on logging and a staff sign-in check, and write the incident runbook.
      • Complete a standard questionnaire once and keep the answers on file.

      First enterprise deal

      • Ask what evidence the buyer needs before you start any audit.
      • If they name SOC 2 or ISO/IEC 27001, ask an auditor or certification body what the work involves before you promise the buyer a date.
      • Offer customer single sign-on and audit log access if the buyer asks.
      • Review ownership terms. Our article on who owns the code shows what to settle.

      Still deciding whether to build? Read custom software or off the shelf, and see our MVP article for scoping a first release.

      Questions to ask an adviser

      • Am I a controller, a processor or both for each kind of data I hold?
      • Does the GDPR apply to my product, and does UK law apply separately?
      • Which US state laws apply to my customers, and am I a service provider under them?
      • Which contract paper do I use, and what do I accept from a buyer?
      • Which evidence should I plan for first: a questionnaire, a penetration test, SOC 2 or ISO/IEC 27001?

      This is general information, not legal or tax advice. Check the current rules or ask a qualified adviser before you decide.

      ESTASOFT can help with product engineering, and it has offices in Dubai, Erbil and London. Send a short brief on the contact page.

      Sources

      Written by
      ESTASOFT

      Need help with a project?

      Share a short brief. We reply with next steps.

      Start a project Book a call

      Book a call

      30 minutes. Free.

      Tell us about your project and we will suggest a time.

      Send a request

      Or email us at info@estasoft.com

      Cookie preferences

      Necessary

      Needed for the site to work. Always on.

      Always on

      Preferences

      Remember choices such as language and region.

      Analytics

      Help us understand which pages are useful.

      Marketing

      Used to measure and improve campaigns.