Controller or processor? It matters.
SaaS companies face unique GDPR challenges. You're a controller for your own customer data, but often a processor for the data your customers store in your platform. Different rules apply to each.
When end-users submit DSARs, the response path depends on your role. SAR Portal helps you track and handle the requests you're responsible for, and log the ones where you support a customer's response.
Common DSAR scenarios for SaaS companies
Direct customer requests
Your paying customers (the businesses) request their account data, billing history, and usage information. You're the controller here.
End-user requests via customers
Your customer receives a DSAR from their user and asks you to help locate data. You need to support this as their processor.
Employee and contractor data
Tech companies have employees with extensive data footprints — code commits, Slack messages, performance data. Departing staff may request this.
Prospective customer data
People who signed up for trials, demos, or marketing but never converted. They still have data rights.
Where SaaS companies hold personal data
Product Database
User accounts, preferences, activity logs
Billing Systems
Payment details, invoices, subscriptions
Support Tickets
Help desk, live chat, email support
Analytics
Usage tracking, behaviour data, session recordings
Marketing Tools
Email lists, CRM, lead scoring
Development Tools
Bug reports, feature requests, API logs
How SAR Portal helps SaaS companies
Controller and processor requests in one place
Track every request in one place, and record in the case notes whether you act as controller or as a processor for a customer.
Export in standard formats
Export case data as JSON or PDF for your own records and tools.
Scale with your customer base
As volume grows, move up a plan. Enterprise is priced for your volume.
Demonstrate compliance to customers
Enterprise customers ask about your GDPR processes. Show them a professional system with full audit trails.