GDPR for SaaS Companies: Processor Obligations and Sub-Processor Lists

Controller vs Processor in SaaS

• Customer usually determines purposes/means for tenant data → controller
• SaaS vendor processes on instructions → processor
• Vendor remains controller for its own website leads, billing contacts, employee data

Sub-Processor Lists

Publish a current list (hosting, email, support tools, AI subprocessors). Article 28 requires prior authorisation patterns and equivalent contractual obligations. Give customers a change-notice mechanism.

How CyberSilo Helps

• CSA evidence for Art 32 and customer audits
• ThreatHawk logs for access and incident timelines

Frequently Asked Questions

Is every SaaS a processor?

For customer-uploaded personal data, usually yes. Marketing analytics on your own site is typically controller processing.

Do I need SCCs if I host in the EU only?

Maybe not for storage — but support tools, subprocessors, or admin access from third countries can still create transfers.

What do enterprise buyers ask first?

DPA, sub-processor list, transfer mechanism, breach SLA, and SOC 2/ISO evidence alongside GDPR answers.

Related GDPR Resources

GDPR hub · DPA · Transfers · CSA