Checklists

GDPR Readiness Checklist for SaaS Companies Getting ready for GDPR can feel overwhelming, especially for startups or growing SaaS businesses. This checklist breaks down the key areas you need to focus on to become GDPR-ready and demonstrate accountability if audited. While GDPR is a legal framework, much of the work comes down to clear data practices, risk reduction, and transparency with users. 1. Data Inventory and Mapping Identify all personal data your company collects (e.g., email, name, IP address) Map data flows — where data comes from, where it’s stored, and where it goes Document all third-party tools that process personal data (e.g., CRMs, analytics, cloud providers) 2. Lawful Basis for Processing Define the legal basis for each data processing activity (e.g., consent, contract, legal obligation) Ensure consent is freely given, specific, informed, and unambiguous Maintain records of consent collection and allow easy withdrawal 3. Privacy Notices and Transparency Update your Privacy Policy to clearly explain: What data you collect Why you collect it Who you share it with How long you keep it Users’ rights under GDPR Make the policy easy to find and accessible in all relevant languages 4. Data Subject Rights Handling Set up a process to respond to Data Subject Requests (DSRs) within 30 days Enable users to: Access their data Correct inaccurate data Request deletion Object to processing Export data (data portability) 5. Security Measures Implement appropriate technical and organizational security controls (e.g., encryption, access management) Maintain an up-to-date incident response plan Run regular security training for employees 6. Data Processing Agreements (DPAs) Sign a DPA with each third-party processor that handles personal data Ensure the DPA covers: Purpose of processing Data protection obligations Sub-processors International transfers 7. International Data Transfers Verify if you’re transferring data outside the EU or EEA Use Standard Contractual Clauses (SCCs) or other approved mechanisms Monitor updates from the European Data Protection Board (EDPB) on cross-border transfers 8. Records of Processing Activities (RoPA) Maintain an internal record of: Categories of data subjects and personal data Processing purposes Data recipients Retention schedules Security measures in place 9. Appointing a Data Protection Officer (DPO) Determine if you’re legally required to appoint a DPO If not required, designate a privacy lead or responsible team Ensure they’re involved in privacy reviews and decisions 10. Breach Response Create a process for identifying and reporting personal data breaches Notify authorities within 72 hours if the breach risks individual rights Communicate clearly with affected individuals if necessary 11. Vendor Management Assess the privacy practices of vendors handling personal data Regularly review vendor compliance and terminate risky partnerships Track sub-processors used by your vendors 12. Continuous Monitoring Run regular GDPR audits or privacy reviews Update policies and processes as your product or business evolves Train teams on privacy best practices and legal obligations Final Thoughts Becoming GDPR-compliant is not a one-time task—it’s a mindset and a continuous commitment. Startups that build privacy into their products and culture early save time and reduce risk later. ...

ISO 27001 Readiness Checklist ISO 27001 is one of the most widely adopted information security standards in the world. If your company is preparing for certification, this checklist will help you understand the essential steps involved — from defining your security policies to preparing for the audit itself. Whether you’re a fast-moving startup or scaling SaaS business, this guide simplifies what to expect and how to prepare. 1. Define the Scope of Your ISMS Identify the parts of your business to include (e.g. product, infrastructure, customer data) Document the boundaries and interfaces of your ISMS Consider locations, teams, tools, and third-party dependencies 2. Conduct a Risk Assessment Identify potential security risks to your information assets Evaluate their likelihood and potential impact Define a risk treatment plan to mitigate or accept risks Maintain a risk register and update it regularly 3. Develop Required Documentation Information Security Policy Risk Assessment Methodology Statement of Applicability (SoA) Asset Management Policy Access Control Policy Incident Response Plan Business Continuity Plan Note: Documentation must align with the ISO 27001 control set (Annex A). ...