What mandatory disclosures must be included in a GDPR-compliant Privacy Policy?

Under GDPR Article 13/14, a Privacy Policy must disclose: (1) Identity & contact details of Data Controller, (2) Categories of personal data collected, (3) Legal bases for processing (Consent, Contract performance, Legitimate Interest), (4) Third-party data recipients, (5) Data retention periods, and (6) User rights (Access, Erasure, Portability).

Does GDPR apply to US or non-EU companies operating SaaS applications?

Yes! GDPR applies extraterritorially to ANY company worldwide that targets, collects, or processes personal data of individuals located within the EU or UK, regardless of where the company is legally registered.

What are the penalties for non-compliant Privacy Policies under GDPR?

GDPR fines can reach up to €20 Million or 4% of global annual turnover (whichever is higher) for severe data privacy violations.

What is the difference between a Data Controller and a Data Processor?

A Data Controller determines the purposes and means of processing personal data. A Data Processor processes data on behalf of the Controller under strict instructions (regulated by a Data Processing Agreement).

What cookie consent disclosures are required for web applications?

Web applications using analytics, marketing, or tracking cookies must deploy an explicit Cookie Consent Banner requiring active opt-in consent before non-essential cookies are dropped.

Blog/Legal Contract Drafting

GDPR Privacy Policy Requirements for SaaS & Web Applications: What to Disclose

A comprehensive data privacy compliance guide for SaaS founders, software developers, and web app operators on satisfying EU GDPR Article 13 and UK DPA mandatory privacy disclosures.

ADVAQ Data Privacy Team

8 Min Read · Published July 2026

EU GDPR & UK DPA Compliant

GDPR Privacy Policy Checklist

•Data Controller Identification: Company legal name, registered address, and DPO email.
•Legal Basis Mapping: Specify exact lawful basis (Consent, Contract, Legitimate Interest) for each data type.
•User Data Rights: Explicit details on how users request data erasure (Right to be Forgotten) or export.
•Third-Party Sub-Processors: List cloud hosts, analytics providers, and payment gateways.

1. Why GDPR Applies Globally to SaaS Applications
2. Mandatory Article 13 Privacy Disclosures
3. Identifying Lawful Bases for Processing Data
4. Managing User Rights & Cookie Consent Banners
5. Frequently Asked Questions

1. Why GDPR Applies Globally to SaaS Applications

Under Article 3(2), GDPR applies to any software application or platform that processes personal data of EU/UK residents, regardless of where your startup is legally incorporated.

2. Mandatory Article 13 Privacy Disclosures

Your privacy policy must clearly state: (1) Data collected, (2) Purpose of processing, (3) Data retention schedules, and (4) International data transfer mechanisms (e.g. EU Standard Contractual Clauses).

Draft GDPR-Compliant Privacy Policies with ADVAQ

ADVAQ drafts custom GDPR, CCPA, and UK DPA Privacy Policies tailored for SaaS platforms, mobile apps, and e-commerce websites.

Order Privacy Policy Package

3. Identifying Lawful Bases for Processing Data

Every data processing activity must rely on one of six legal bases under GDPR Article 6, most commonly: Performance of a Contract, Legitimate Interest, or Explicit Consent.

4. Managing User Rights & Cookie Consent Banners

Provide transparent instructions enabling users to exercise data rights, and deploy an explicit cookie consent banner before firing non-essential tracking pixels.

Frequently Asked Questions

DATA PRIVACY COMPLIANCE SOLUTIONS

Ensure Full GDPR & CCPA Compliance

GDPR privacy policies, cookie consent policy drafting, sub-processor disclosures, and user data rights management templates.

Order GDPR Privacy Policy WhatsApp Us Directly