The General Data Protection Regulation (GDPR) is a comprehensive data privacy law enacted by the European Union that governs how organizations collect, process, store, and protect the personal data of individuals in the EU and European Economic Area. GDPR applies to any organization worldwide that processes EU residents' data, regardless of where the organization is based.
The General Data Protection Regulation, or GDPR, is the EU's flagship data privacy law, and arguably the most influential data protection regulation globally. Effective since May 2018, GDPR establishes strict rules about how organizations handle personal data belonging to people in the EU and EEA.
The critical thing for startups to understand: GDPR applies based on whose data you process, not where your company is located. If your SaaS product has a single user in Germany, GDPR applies to you. If your marketing website collects email addresses from visitors in France, GDPR applies. Geographical location of your headquarters is irrelevant.
GDPR is built on seven core principles:
GDPR's Article 32 requires "appropriate technical and organizational measures" to protect personal data. While GDPR doesn't prescribe specific security tools, it expects controls proportionate to the risk, including:
This is where your cybersecurity program directly supports GDPR compliance. The same vulnerability management, access controls, and incident response that satisfy SOC 2 also address GDPR's security requirements.
Yes, if you process personal data of EU or EEA residents. GDPR has extraterritorial reach: it applies to any organization offering goods or services to people in the EU or monitoring the behavior of people in the EU, regardless of where the organization is headquartered. If your SaaS product has European users, your website targets European visitors, or your marketing reaches EU audiences, GDPR applies. The key question isn't where your company is incorporated but whose data you handle.
GDPR defines personal data broadly as any information relating to an identified or identifiable natural person. This includes obvious identifiers like names, email addresses, phone numbers, and physical addresses. It also includes IP addresses, cookie identifiers, device IDs, location data, online identifiers, and any information that could be combined with other data to identify someone. "Special categories" of data (health, biometric, genetic, racial/ethnic, political, religious data) have even stricter protections. If you're unsure whether something is personal data under GDPR, it probably is.
GDPR is a law that governs how you handle personal data of EU residents. Non-compliance carries legal penalties including fines. SOC 2 is a voluntary audit framework that evaluates your security controls against the AICPA Trust Services Criteria. There's no legal penalty for not having SOC 2, though customers may require it. They're complementary: GDPR tells you what you must do with personal data (legal requirement), while SOC 2 provides a framework for proving your security controls work (market requirement). The security controls that satisfy SOC 2 often address GDPR's Article 32 security requirements as well.
