Skip to content

ISO 27001, SOC 2, the DPDP Act and manual VAPT. Book a Free Scoping Call

Compliance

GDPR and UK GDPR Readiness for Asia-Pacific SaaS Companies

An Asia-Pacific SaaS company falls under the GDPR when it offers goods or services to people in the EU or monitors their behaviour there, even with no office in Europe (Article 3(2)), and under the UK GDPR on the same tests for people in the UK. Selling to European business customers who give you their users' data usually makes you their processor, bound by Article 28 terms in your contract. Readiness means fixing your role for each activity, appointing an EU or UK representative where required, keeping records of processing, running impact assessments for high-risk processing and putting a lawful tool behind every transfer. There is no universal GDPR certification. SecureRoot builds and documents that programme; it is not a law firm and does not certify compliance.

Request a privacy assessmentContact SecureRoot

About this guide

Written by SecureRoot Risk Advisory LLP.

Start here

Does the GDPR reach you? Article 3 in three questions

Article 3 of the GDPR decides whether it applies, and it looks at what you do with people's data, not where your servers or offices are. Answer three questions for each product and each entity in your group.

  1. 01

    Do you have an establishment in the EU?

    Article 3(1) applies the GDPR to processing in the context of the activities of an establishment in the Union, whether or not the processing itself happens in the Union. A European subsidiary, branch or team with a stable presence can bring that entity's processing in scope.

  2. 02

    Do you offer goods or services to people in the EU?

    Article 3(2)(a) applies the GDPR to a controller or processor not established in the Union when its processing relates to offering goods or services to people in the Union, whether or not they pay. A free tier counts. Recital 23 explains the test as an apparent intention to offer: using a language or currency generally used in a member state with the ability to order in it, or mentioning customers or users in the Union, points towards offering, while a website that can merely be reached from Europe does not on its own.

  3. 03

    Do you monitor their behaviour in the EU?

    Article 3(2)(b) covers monitoring of behaviour that takes place in the Union. For a SaaS product this usually means tracking and profiling: product analytics tied to individual users, behavioural advertising, or scoring based on how people use the service.

If none of the three applies, the GDPR does not apply to you directly. You can still be bound to GDPR-standard terms by contract when a European customer uses you as its processor, which is the next section.

Your role

Controller or processor, decided per activity

A SaaS company is usually both. For your own account sign-ups, billing, marketing and product analytics, you decide why and how the data is processed, so you are the controller. For the data your business customers load into the product about their own staff or end users, you act on their instructions, so you are their processor.

The role changes the duties. A controller needs a lawful basis for each purpose, gives the privacy notice and answers rights requests. A processor may act only on the controller's documented instructions under a contract that meets Article 28: confidentiality for staff, appropriate security, sub-processors only with the controller's authorisation and on equivalent terms, help with rights requests and impact assessments, deletion or return at the end, and information and audits that show compliance. Article 28(1) requires controllers to use only processors that give sufficient guarantees, which is why European customers send security questionnaires before they sign.

  • List each processing activity and record whether you are controller or processor for it.
  • Keep a current sub-processor list (cloud hosting, email delivery, support desk, analytics, error tracking) with the location of each, because your customers' contracts will require notice before you change it.
  • Check that your standard data processing agreement matches what your platform actually does, especially deletion on termination and breach notice timing.
Controller or processor: what changes for a SaaS company
AspectAs controllerAs processor
Typical SaaS activitiesYour own account sign-ups, billing, marketing and product analyticsThe data your business customers load into the product about their own staff or end users
Who decidesYou decide why and how the data is processedYou act only on the controller's documented instructions
Core dutiesA lawful basis for each purpose, the privacy notice, and answering rights requestsA contract meeting Article 28: staff confidentiality, appropriate security, sub-processors only with authorisation and on equivalent terms, help with rights requests and impact assessments, deletion or return at the end, and information and audits that show compliance
Records of processing (Article 30)Records of your processing activitiesRecords of the processing you carry out for each controller
A personal data breach (Article 33)Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless it is unlikely to result in a risk to individualsNotify your controller without undue delay

Representatives

EU and UK representatives

Where Article 3(2) applies, Article 27 requires a controller or processor with no EU establishment to designate a representative in the Union in writing. The representative must be established in a member state where the people whose data you process are, and acts as a contact point for supervisory authorities and individuals. The duty does not apply to processing that is occasional, does not include large-scale processing of special category or criminal offence data, and is unlikely to result in a risk to people's rights, nor to public authorities. A SaaS business that actively sells into Europe rarely fits that exception.

The UK runs the same structure. The UK regulator, the Information Commission (formerly the Information Commissioner's Office, ICO), says that an organisation based outside the UK with no branch, office or other establishment there, which offers goods or services to people in the UK or monitors their behaviour, must comply with the UK GDPR and appoint a UK representative, authorised in writing, unless it is a public authority or its processing is only occasional, low risk and does not involve large-scale special category or criminal offence data. The Commission is clear that having a representative does not affect your own responsibility or liability.

A representative is a service you contract for. SecureRoot does not act as one; an EU representative service sits outside SecureRoot's fee.

Accountability

Records of processing and impact assessments

Article 30 requires a controller to keep records of its processing activities, including purposes, categories of data and recipients, transfers and security measures, and a processor to keep records of the processing it carries out for each controller. The exemption for organisations with fewer than 250 employees does not apply where processing is likely to result in a risk, is not occasional, or includes special category or criminal offence data. Continuous processing of customer data in a SaaS product is not occasional, so plan to keep records whatever your headcount.

Article 35 requires a data protection impact assessment before processing that is likely to result in a high risk, particularly with new technologies. It names three cases where one is always required: systematic and extensive automated evaluation, including profiling, that produces decisions with legal or similarly significant effects; large-scale processing of special category or criminal offence data; and large-scale systematic monitoring of publicly accessible areas. For SaaS, the usual triggers are AI-driven scoring of individuals, health or biometric features, and employee monitoring products.

Check Article 37 at the same time: a data protection officer is required where your core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of special category or criminal offence data.

Incidents

Breach notification sets the clock

Under Article 33, a controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals; a later notice must give reasons for the delay. A processor must notify its controller without undue delay. Your customers' contracts will usually turn that into a fixed number of hours, so the incident procedure has to meet the shortest deadline you have signed.

Transfers

Transfers out of Europe to Asia-Pacific

Article 44 permits a transfer of personal data to a country outside the EU, including onward transfers, only under the conditions of Chapter V. A European Commission adequacy decision is the simplest: in Asia-Pacific, the Commission's list includes Japan, the Republic of Korea and New Zealand. India, Singapore, Australia and the other markets in the region are not on it.

For a country without adequacy, the usual tool is the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, which Article 46(2)(c) recognises as an appropriate safeguard. The clauses come in four modules: controller to controller, controller to processor, processor to processor and processor to controller. A SaaS company hosting a European customer's data outside the EU is usually signing Module Two with the customer and Module Three with its own sub-processors, backed by an assessment of the destination country's law and practice and the supplementary measures you use.

Transfers from the UK follow the UK GDPR, and the Data (Use and Access) Act 2025 has reworded the test you apply to them, according to the Information Commission. If you serve both markets, keep separate EU and UK transfer records.

United Kingdom

What the Data (Use and Access) Act 2025 changed in the UK

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025. Its data protection changes were phased in between June 2025 and June 2026, and the Information Commission now states that all provisions affecting data protection law and the Privacy and Electronic Communications Regulations are in force. It amends the UK regime; it does not replace the UK GDPR. The Commission lists these changes for organisations:

  • A new lawful basis, recognised legitimate interests, for certain set purposes such as protecting public security, without a balancing test.
  • A requirement to help people make data protection complaints, for example with an electronic form, to acknowledge complaints within 30 days and to respond without undue delay.
  • Subject access requests need only reasonable and proportionate searches.
  • Significant automated decisions can rely on the full range of lawful bases with appropriate safeguards, except for special category data.
  • Some cookies, such as those for statistical purposes or basic website functionality, can be set without consent.
  • The test for transferring personal information out of the UK has been reworded.

For an Asia-Pacific SaaS company with UK users, the practical additions are a complaints route in the product or on the website, and a check of your cookie consent and transfer documentation against the Information Commission's updated guidance.

Certification

There is no universal GDPR certification

Article 42 provides for data protection certification mechanisms, seals and marks, but certification under it is voluntary, scheme-specific, issued for a maximum of three years, and does not reduce the controller's or processor's responsibility for complying. No single certificate proves GDPR compliance, and a vendor badge that claims to is not one of those mechanisms.

European customers therefore assess evidence: your records of processing, data processing agreement, sub-processor list, transfer documentation, security measures and breach procedure. An ISO/IEC 27701 certificate or a SOC 2 report can support that evidence, but neither is a GDPR certificate.

SecureRoot's part

What SecureRoot does in a GDPR programme

SecureRoot runs GDPR work in six phases: data mapping and lawful basis; a gap assessment against the GDPR articles; rights and consent processes; records of processing and impact assessments; transfers and breach readiness; and a readiness review. The deliverables are records of processing activities, a lawful basis register, a data subject rights workflow, DPIA templates and a breach response procedure.

The fee is scoped, then quoted in writing, with no third-party fee required, and the timeline is quoted with the scope; both are on the pricing page. An EU representative service, legal review in a member state where specific local advice is needed, and your own team's time sit outside SecureRoot's fee.

Scope boundaries

What this does not cover

  • There is no universal GDPR certification, and SecureRoot does not certify GDPR or UK GDPR compliance. A readiness report describes your position on the date of the review; it does not guarantee compliance or the outcome of a customer assessment or a regulator's inquiry.
  • SecureRoot is not a law firm. Whether Article 3 applies to a particular product, and the drafting of contracts, are legal questions your counsel should confirm.
  • SecureRoot does not act as an EU or UK representative or as a data protection officer under this service.
  • SecureRoot works remotely from India and has no offices outside India, in Europe, the UK or elsewhere.
  • Your team owns the processing, implements the controls and keeps the records current after the engagement.

Questions

Common questions

  • We only sell to businesses in Europe, not consumers. Does the GDPR still matter?

    Yes. Your customers' staff and end users are individuals, and your customers will bind you to Article 28 processor terms by contract. If you also market to or track people in the EU, the GDPR can apply to you directly under Article 3(2).

  • Do we need both an EU and a UK representative?

    If the GDPR applies through Article 3(2) and the UK GDPR applies through targeting or monitoring people in the UK, and you have no establishment in either, you usually need both, unless your processing fits the narrow occasional and low-risk exception.

  • Is the Data (Use and Access) Act 2025 in force?

    The Information Commission states that all of its provisions affecting data protection law and the Privacy and Electronic Communications Regulations are in force, after commencement in phases between June 2025 and June 2026.

  • Does ISO/IEC 27701 make us GDPR compliant?

    No. It is a management system standard for privacy that can support your GDPR evidence, but it is not a GDPR certification mechanism under Article 42 and does not prove compliance on its own.

Primary Sources

Where the Figures on This Page Come From

Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.

Related

Services and help that go with this

Find out which regime applies to each product

Tell SecureRoot where your users and customers are, which entities and products are involved, and what your European customers have asked for. We will scope the mapping and readiness work and quote a fixed price in writing.

Request a privacy assessmentContact SecureRoot