A SaaS company can be a Data Processor for customer data and a Data Fiduciary for its own users and prospects - often both.
Know your role per data set
- Customer-uploaded end-user data: usually you are the processor; your customer is the fiduciary.
- Your own account holders, marketing leads and staff: you are the fiduciary.
What customers will ask for
- A written processing contract covering purpose limits, security and sub-processors.
- Breach notification commitments and cooperation.
- Erasure or return of data at contract end.
- Evidence of safeguards: access control, logging, backups, encryption.
Build for rights
Product features such as export, correction and deletion make it easier for your customers to honour Data Principal rights.
Frequently asked questions
Does a SaaS processor have to notify the Board of a breach?+
The duty to intimate sits with the Data Fiduciary. Processors must support the fiduciary, so contracts should require prompt notice to the fiduciary.
Relevant provisions
- Section 8(2)Processors engaged under valid contract
- Section 8(5)Rule 6 · pending verificationReasonable security safeguards
- Section 8(6)Rule 7 · pending verificationPersonal data breach intimation
- Section 8(7)Rule 8 · pending verificationErasure when purpose is served or consent withdrawn
Official sources
Legal reviewPending legal review · drafted 19 Oct 2026
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.