What this guide helps you evaluate
U.S.-based SaaS companies that offer services to people or organizations in the EEA or otherwise fall within GDPR scope.
Prepared by the PROFENG Editorial & Engineering Team. This page is designed to help you compare the moving parts, organize due diligence and ask better questions before you commit money, sign a contract or change an operating process.
What to compare first
- Controller, processor and sub-processor roles
- Lawful basis, transparency and data minimization
- Article 28 processing agreements
- International transfer mechanism and vendor chain
- Data-subject rights, security, retention and breach response
Step-by-step process
- 01
Map personal data, purposes, systems, vendors and geographic transfers.
- 02
Determine role and lawful basis for each material processing activity.
- 03
Put processor contracts and sub-processor controls in place.
- 04
Create workflows for access, deletion and other rights requests.
- 05
Test incident response, including the information needed for breach assessment and notification.
Common mistakes and risk checks
- Assuming a U.S. company is outside GDPR automatically.
- Copying a privacy notice without matching actual processing.
- Ignoring sub-processors and international transfers.
Primary and official references
Rules, pricing and requirements can change. Use these sources to verify the latest details that apply to your situation.
How to use and verify this guide
Use the comparison criteria and questions as a decision framework, then verify current prices, legal requirements, technical specifications, service terms and regulatory obligations with the primary or official references listed above. PROFENG explains its source, calculation and review principles on the methodology page.