SaaS GDPR Compliance Checklist for Developer Tools

TL;DR: GDPR applies to any SaaS with EU users, regardless of where you're based. This guide covers the technical and legal requirements: data inventory, consent management, data subject access requests (DSAR), right to erasure, data processing agreements, and breach notification processes.

Introduction

GDPR isn't optional for SaaS products. If you have even one user from the EU, GDPR applies to your business. The regulation covers how you collect, store, process, and delete personal data. For a broader overview of the legal agreements your SaaS needs, see SaaS Legal Essentials.

Technical Implementation

Implementing GDPR compliance technically requires endpoints for data export (DSAR), right to erasure, and consent management. The following server functions handle these core data subject requests:

// Data export for DSAR
export const exportUserDataFn = createServerFn({ method: 'GET' })
  .handler(async ({ context }) => {
    const userId = context.user.id

    const [profile, subscriptions, events] = await Promise.all([
      db.selectFrom('users').where('id', '=', userId).executeTakeFirst(),
      db.selectFrom('subscriptions').where('user_id', '=', userId).execute(),
      db.selectFrom('events').where('user_id', '=', userId).execute(),
    ])

    return { profile, subscriptions, events }
  })

// Right to erasure
export const deleteUserDataFn = createServerFn({ method: 'POST' })
  .handler(async ({ context }) => {
    const userId = context.user.id
    // Anonymize or delete all user data
    await db.deleteFrom('events').where('user_id', '=', userId).execute()
    await db.deleteFrom('sessions').where('user_id', '=', userId).execute()
    await db.updateTable('users')
      .set({ email: `deleted-${userId}@anon.com`, name: 'Deleted User', anonymized: true })
      .where('id', '=', userId)
      .execute()
  })

These functions cover the two most common data subject requests — data portability and the right to be forgotten. For securing these endpoints and protecting user data, apply SaaS security best practices.

GDPR Checklist

Consent management requires both a cookie consent implementation for the frontend and a backend system for storing consent records with timestamps.

Conclusion

GDPR compliance is a combination of legal documentation and technical implementation. The technical side — consent management, data export, right to erasure — is straightforward with TanStack Start server functions. For SaaS products expanding globally, see International SaaS Data Compliance for region-specific requirements beyond GDPR.