GDPR for Tiny SaaS Companies

GDPR is real. It is also navigable for a 3-person team. Here's the minimum.

The non-negotiables

1. Privacy policy that's accurate (not boilerplate).
2. Lawful basis documented for every data collection point.
3. Data deletion mechanism — users must be able to delete themselves.
4. Sub-processor list, kept current.

What "lawful basis" actually means

Six bases. For SaaS the relevant three are usually: consent (newsletter signup), contract (you can't deliver service without it), legitimate interest (analytics in some contexts).

The DPA shuffle

Every sub-processor you use (Vercel, Postmark, Stripe, etc.) requires a signed DPA. Most have one online. Take an hour, sign them all, keep copies.

When to actually worry

Not in pre-seed. Genuinely worry when: you cross 250 employees, you serve regulated industries, or you handle special category data (health, financial, biometric).