Software publishers & GDPR: the processor's obligations

What does GDPR cover?

The GDPR distinguishes between the data controller, who determines the purposes, and the processor, who acts on their behalf. The SaaS publisher is the archetypal processor: it hosts and processes data whose purposes are defined by its client.

Article 28 requires a written contract strictly governing what the processor may do, how it secures the data, and what happens to it at the end of the relationship.

Is the 'Software Publishers' sector concerned?

Any software publisher processing personal data on behalf of its clients is a data processor, with no threshold. The qualification depends neither on size nor sector, but on the reality of the processing.

The software publisher becomes a data controller, however, as soon as it defines its own purposes: product audience measurement, commercial prospecting, or training AI models on its clients' data. It then holds both capacities simultaneously, along with the corresponding obligations.

Detailed obligations

Sanctions & risks

Fines can reach €20M or 4% of global turnover. A non-compliant vendor exposes all of its customers in a cascade effect, making it a major contractual failure point and a recurring topic in due diligence.

On top of administrative risk comes contractual risk: clients now require guarantees (DPA, certifications, tests) and may hold the publisher liable in the event of a breach.

Common mistakes in the sector

• 1No standardised DPA. Negotiating on a case-by-case basis in the absence of a standard contract, which slows down sales and leaves gaps.
• 2Hidden sub-processors. Failing to disclose the hosting provider or third-party services, in breach of the information obligation.
• 3Unregulated transfers outside the EU. Using non-EU services without contractual clauses or supplementary measures.
• 4Deficient notification. Failing to notify the client without delay in the event of a breach.

Practical case

An HR software publisher hosts candidate data for its clients via an undeclared non-EU cloud sub-processor. During a security audit conducted by a major account, the absence of any mention of the sub-processor and transfer clauses blocks the signing of the contract. The publisher regularises the situation by declaring the sub-processor, activating standard contractual clauses, and publishing a standard DPA — now a systematic requirement for its enterprise sales.

Compliance roadmap

1. 1

   Map data flows. Map the data processed, its location, sub-processors, and transfers outside the EU.

2. 2

   Publish a standard DPA. Make a standard DPA and security documentation readily available to clients.

3. 3

   Maintaining the list of subprocessors. Keep the list of sub-processors and the client information mechanism up to date.

4. 4

   Document security. Formalise Article 32 measures in a register and keep them up to date.

5. 5

   Equip the notification process. Establish a procedure for detecting and notifying breaches to the client without delay.

Frequently asked questions