Short answer: A small SaaS that serves people in the EU needs, at minimum: a privacy policy that says what you collect, why and for how long; a legal basis for each use; a data processing agreement with every service that handles your users' data; consent before any non-essential tracking; a way to answer access and deletion requests within a month; a plan to report a breach within 72 hours; and a lawful route for any data that leaves the EU. In Germany you also need an Impressum. This is a starting list, not legal advice.
The GDPR applies whether or not you are based in the EU, as soon as you offer a product to people there. Most of what a small company needs is paperwork and settings, not engineering.
List each kind of personal data (email, name, payment details, IP addresses, analytics, support messages), why you have it, where it is stored, and when you delete it. This is the start of your record of processing (Article 30) and the source for everything below.
Running the service someone signed up for is "contract". Marketing emails usually need consent. Fraud prevention is often "legitimate interest". Article 6 lists the options; write yours next to each line.
Who you are, what you collect, why, the legal basis, who you share it with, how long you keep it, and how people exercise their rights (Articles 13 and 14). Link it from every page.
Your host, database, email provider, analytics and support tool process data for you. Each needs a data processing agreement (Article 28). Most providers offer one to accept online. If you sell to businesses, your customers will ask you for yours.
Analytics and ad pixels that set cookies or read the device need consent before they load (the ePrivacy rules; in Germany §25 TDDDG). "Strictly necessary" cookies, such as the sign-in session, do not.
People may ask for a copy of their data, a correction, or deletion. You have one month to answer (Article 12). Make sure you can find and delete one person's data across your database, backups policy and tools.
If personal data leaks, you must tell your data protection authority within 72 hours of finding out (Article 33), and the people affected if the risk is high. Decide now who does what.
Data leaving the EU needs a legal route: the EU–US Data Privacy Framework for certified US companies, or standard contractual clauses. Pick EU regions for your database and hosting where you can.
Article 32 asks for "appropriate" security. Open database rules or a leaked key is the classic way a small company ends up reporting a breach. Check your database rules.
You can do all of the above by hand. If you'd rather start with a list of what's wrong, the vibeship quick check runs from outside, the way a stranger sees your site. The quick check is free and needs no account. It shows your grade and how many problems sit in each area; what each problem is and how to fix it is in the full report.
Yes, if you offer your product to people in the EU or monitor their behaviour (Article 3). Being small does not exempt you, though some record-keeping duties are lighter under 250 employees.
Only if you use cookies or similar tracking that is not strictly necessary, such as most analytics and all ad pixels. Cookieless analytics and a sign-in cookie alone do not need one.
Usually not for a small SaaS, unless your core activity is large-scale monitoring of people or handling special categories of data such as health. In Germany the threshold also depends on how many people regularly process personal data.
A legal notice German law requires on commercial websites (§5 DDG): who runs the site, a postal address and a fast way to make contact. Austria and Switzerland have similar rules.
Sources checked on 25 October 2026.