Enterprise SaaS: key go-global obligations

A controller or processor that is caught by Art. 3(2) but not established in the EU must designate an EU representative in writing, established in one of the Member States where the relevant data subjects are. The representative must be mandated to be addressed, in addition to or instead of the controller or processor, by supervisory authorities and data subjects on all processing-related issues. The only exemptions are processing that is occasional, does not include large-scale processing of Art. 9(1) special categories or Art. 10 criminal-conviction data, and is unlikely to result in a risk to natural persons; and public authorities.

A DPO must be designated in three cases: processing carried out by a public authority or body, except courts acting judicially; where the core activities of the controller or processor consist of processing operations that, by their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale; or where the core activities consist of large-scale processing of Art. 9 special categories or Art. 10 criminal-conviction data. The DPO must be designated on the basis of professional qualities, in particular expert knowledge of data protection law and practice, and may be a staff member or fulfil the tasks under a service contract. A group of undertakings may appoint a single DPO provided the DPO is easily accessible from each establishment.

Controllers and their representatives must maintain records of processing activities under their responsibility, containing at least the name and contact details of the controller, joint controllers, representative and DPO; the purposes of processing; the categories of data subjects and of personal data; the categories of recipients including recipients in third countries; identification of third countries and the safeguards used for transfers; the envisaged erasure time limits for each category; and a general description of the Art. 32(1) technical and organisational security measures. The Art. 30(5) exemption for organisations with fewer than 250 employees is very narrow: it does not apply where the processing is likely to result in a risk to data subjects’ rights and freedoms, is not occasional, or involves special categories or criminal-conviction data.

Each processing activity, including training or fine-tuning models on user data, must have a documented Art. 6 lawful basis; processing of Art. 9(1) special categories additionally requires an Art. 9(2) exception. Where consent is relied on, it must meet the Art. 4(11) and Art. 7 requirements of being freely given, specific, informed and unambiguous, withdrawable at any time and as easily as it was given. Where legitimate interests are relied on, a three-part balancing test must be performed and retained. Information to data subjects must cover all Art. 13 and 14 elements, and Art. 14(3) requires notice within a reasonable period and at the latest within one month where data was not obtained from the data subject.

Build a demonstrable process covering access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making. Under Art. 12(3), the controller must inform the data subject of the action taken without undue delay and in any event within one month of receipt, extendable by two further months for complex or numerous requests provided the data subject is informed of the extension and the reasons within the first month. Responses are free of charge except for manifestly unfounded or excessive requests. For AI companies the hard part is locating and acting on personal data that has entered training sets and vector indexes, and explaining whether it remains reproducible in model outputs.

Where a type of processing, in particular using new technologies and taking account of its nature, scope, context and purposes, is likely to result in a high risk to natural persons’ rights and freedoms, the controller must carry out a DPIA before processing. Art. 35(3) lists three mandatory cases: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions producing legal or similarly significant effects are based; large-scale processing of Art. 9(1) special categories or Art. 10 criminal-conviction data; and systematic monitoring of a publicly accessible area on a large scale. The DPO’s advice must be sought where one is designated. Where the DPIA indicates a high residual risk absent mitigation, the supervisory authority must be consulted before processing (Art. 36).

A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. Only three exceptions apply: the decision is necessary for entering into or performing a contract between the data subject and the controller; it is authorised by Union or Member State law laying down suitable safeguards; or it is based on the data subject’s explicit consent. In the contract-necessity and explicit-consent cases the controller must implement suitable safeguards including, at least, the right to obtain human intervention, to express a point of view and to contest the decision. Such decisions must not be based on Art. 9(1) special categories unless Art. 9(2)(a) or (g) applies with suitable safeguards in place.

On a personal data breach the controller must notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to natural persons’ rights and freedoms; a notification made later must be accompanied by reasons for the delay. The notification must at least describe the nature of the breach including the categories and approximate numbers of data subjects and records concerned, give the DPO or other contact point, describe the likely consequences, and describe measures taken or proposed. Information may be provided in phases. A processor must notify the controller without undue delay after becoming aware. Where the breach is likely to result in a high risk, the controller must also communicate it to the data subjects without undue delay in clear and plain language. The controller must document all breaches, their effects and the remedial action taken, so the authority can verify compliance.

A controller may only use processors providing sufficient guarantees to implement appropriate technical and organisational measures, and the processing must be governed by a contract or other binding legal act setting out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects, and the controller’s rights and obligations. A processor must not engage another processor without prior specific or general written authorisation from the controller; under a general authorisation the processor must inform the controller of intended additions or replacements, giving it the opportunity to object.

Controllers and processors must implement appropriate technical and organisational measures ensuring a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to natural persons. Measures may include pseudonymisation and encryption; the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore availability and access in a timely manner after an incident; and a process for regularly testing, assessing and evaluating effectiveness. Data protection by design and by default must also be implemented at the time of determining the means of processing and during the processing itself (Art. 25).

Transfers of personal data to a third country or international organisation are permitted only under Chapter V: an adequacy decision of the Commission (Art. 45); appropriate safeguards (Art. 46, including Commission-adopted standard data protection clauses, binding corporate rules, approved codes of conduct or certification mechanisms, together with enforceable data subject rights and effective remedies); or the Art. 49 derogations for specific situations. China is not covered by an EU adequacy decision, so the default route for Chinese AI companies is to execute standard contractual clauses and complete a transfer impact assessment identifying how the destination country’s law affects the effectiveness of those clauses, and to adopt supplementary measures.

Connected products must be designed and manufactured, and related services designed and provided, so that product data and related service data, including the metadata necessary to interpret and use them, are by default easily, securely and free of charge available to the user in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, directly accessible. The obligation applies to connected products and related services placed on the EU market after 12 Sep 2026.

Where data cannot be accessed directly from the product or related service, the data holder must make readily available data and the necessary metadata accessible to the user without undue delay, of the same quality as is available to the data holder, easily, securely and free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real time, on the basis of a simple electronic request where technically feasible. The user may also require the data holder to make that data available to a third party of the user’s choosing on equivalent terms. The data holder may contractually restrict or prohibit sharing only where it could undermine statutory product security requirements with a serious adverse effect on health, safety or security of natural persons, and must notify the competent authority designated under Art. 37 when it refuses. Undertakings designated as gatekeepers under the Digital Markets Act cannot be eligible third parties.

Providers of data processing services must take the measures in Arts. 25, 26, 27, 29 and 30 to enable customers to switch to another provider of the same service type, to on-premises ICT infrastructure, or where relevant to use several providers at once, and must remove commercial, technical, contractual and organisational obstacles to terminating the contract, concluding a new contract with another provider, and porting exportable data and digital assets, including after using a free tier. From 12 Jan 2027 no switching charges may be imposed; between 11 Jan 2024 and 12 Jan 2027 only reduced charges not exceeding the costs directly linked to the switching process are allowed. Before contracting, providers must clearly inform prospective customers of standard service fees, early-termination penalties and any reduced switching charges applicable during the transition, and must publish that information in a dedicated section of their website or another easily accessible way.

Providers of data processing services must take all adequate technical, organisational and legal measures, including contracts, to prevent international and third-country governmental access to and transfer of non-personal data held in the Union where such access or transfer would conflict with Union law or the national law of the relevant Member State. A third-country court, tribunal or administrative decision requiring transfer or access is recognised or enforceable only if based on an international agreement in force between the requesting third country and the Union or a Member State, such as a mutual legal assistance treaty. Absent such an agreement, transfer or access may occur only where the three cumulative conditions in Art. 32(3) are met: the third-country system requires the reasons and proportionality of the decision to be set out and requires it to be specific in character; the addressee’s reasoned objection is subject to review by a competent third-country court; and that court is empowered to take due account of the relevant legal interests of the data provider protected by Union or Member State law.