What Happens If Your SaaS Is Not GDPR Compliant?

GDPR has been in force since May 2018. In the years since, regulators across the EU have issued over €4.5 billion in fines. Most of those fines did not go to tech giants — they went to companies that thought the law did not apply to them, or figured the risk of getting caught was low.

If your SaaS has any users in the EU — even a small percentage — GDPR applies to you. Here is exactly what happens when you are not compliant.

The Fine Tiers

GDPR creates two tiers of administrative fines. Tier 1 violations — not having a DPA with processors, poor data security, failing to notify a breach — can result in fines up to €10 million or 2% of global annual turnover.

Tier 2 violations — unlawful processing, lack of valid consent, violations of data subject rights — can reach €20 million or 4% of global annual turnover, whichever is higher. For a startup with €2M revenue, that is an €80,000 maximum. For a company with €50M revenue, that is €2 million.

How Investigations Start

• —User complaints: Any EU resident can file a complaint with their national data protection authority. This is free and easy to do.
• —Competitor reports: Competitors regularly report each other for GDPR violations as a strategic move.
• —Regulatory sweeps: DPAs proactively investigate entire industries — cookie banners, data brokers, and HR software have all been targeted.
• —Breach notifications: When you report a data breach (required within 72 hours), it triggers an investigation into your overall compliance posture.

What Investigators Look For First

• —Is there a privacy policy? Is it accurate and up to date?
• —Do you have valid consent mechanisms for cookies and marketing?
• —Do you have Data Processing Agreements with your vendors?
• —Can users exercise their rights — access, deletion, portability?
• —Do you have a process for handling data breaches?

Business Consequences Beyond Fines

• —Enterprise deals blocked: Procurement teams require GDPR compliance documentation before signing contracts. Non-compliance kills deals.
• —Reputational damage: Regulatory actions are public record. A fine announcement appears in searches for your company name.
• —Investor concerns: VCs perform compliance due diligence. Discovered violations delay or kill funding rounds.
• —Processing bans: In severe cases, regulators can ban processing EU personal data — effectively shutting down EU operations.

How to Get Compliant Fast

• —Publish an accurate, GDPR-compliant privacy policy — not a generic template
• —Implement a proper cookie consent banner with granular opt-in
• —Sign Data Processing Agreements with your key vendors
• —Build a process to handle data subject rights requests within 30 days
• —Document your lawful basis for each type of data processing