ComplyDog Blog

Yes, and Recital 49 says so almost in terms. The difficulty is not the basis, it is where monitoring systems becomes monitoring people.

Posted by Kevin Yun | 2026-09-10T18:23:54.796Z

Article 8 sets 16 and lets Member States drop to 13. The tables you will find online disagree with each other, and here is why.

Posted by Kevin Yun | 2026-09-10T18:18:50.186Z

The regulation never defines it. Four regulator factors decide it, and none of them is the size of your company or your headcount.

Posted by Kevin Yun | 2026-09-09T18:41:12.560Z

A decision procedure rather than a glossary. Pick per purpose, before you process, and write down why the others did not fit.

Posted by Kevin Yun | 2026-09-09T18:38:02.943Z

Almost none of it turns on headcount. There is no employee threshold for scope, and the two places numbers appear are narrower than they look.

Posted by Kevin Yun | 2026-09-08T14:58:52.805Z

Usually yes for the part that touches the device, and that is a separate question from your lawful basis for the processing that follows.

Posted by Kevin Yun | 2026-09-08T14:55:48.944Z

The controller and the processor both do. In a B2B SaaS deal your customer signs yours, and you sign your vendors' — often on the same day.

Posted by Kevin Yun | 2026-09-06T15:58:42.261Z

Only vendors that process personal data on your behalf. That is fewer than every supplier and more than most SaaS companies assume.

Posted by Kevin Yun | 2026-09-06T15:52:33.064Z

For most B2B SaaS companies one accountable owner is enough. The regulation asks for accountability and evidence, not for headcount.

Posted by Kevin Yun | 2026-09-05T05:41:33.370Z