Yes, and unusually for a GDPR question the regulation says so in terms. Article 3(2)(a) applies to the offering of goods or services "irrespective of whether a payment of the data subject is required." There is no unpaid exception, no trial period grace, and no beta carve-out. A person who signs up for a fourteen-day trial and never converts is a data subject with the same rights as your largest customer.
This article covers the wording that settles it, the one genuine nuance about who you are actually targeting, which lawful basis fits a free trial, why beta programmes raise sharper questions, and what to do with the data when the trial ends.
The Wording Settles It
Most GDPR questions require you to reason from principles. This one does not.
Article 3(2)(a) extends the regulation to organisations outside the Union where processing relates to "the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union." The EDPB's Guidelines 3/2018 on territorial scope, checked on 8 August 2026, put it plainly: whether an activity counts as an offer of goods or services does not depend on whether payment is made in exchange.
That phrase was drafted precisely because the free-service business model was already dominant. Legislators anticipated exactly the argument that unpaid users are outside scope, and closed it in the text.
The same conclusion follows from the definition side. Article 4(1) defines personal data by reference to an identifiable natural person. Nothing about the definition, or about data subject rights, is conditioned on a commercial relationship. Recital 14 also confirms that nationality and residence are irrelevant; what matters is that the person is in the Union.
The One Genuine Nuance
There is a real qualifier, and it is not about payment.
Recital 23 says that the mere accessibility of your website in the Union, the mention of an email or postal address, or a phone number without an international dialling code, does not by itself demonstrate an intention to offer goods or services to people in the Union. The EDPB adds that where services are inadvertently or incidentally provided to someone in the EU, the related processing does not fall within territorial scope.
The test is whether you envisage offering your service to people in one or more Member States. Indicators include using a Member State language or currency, mentioning EU customers, running EU-targeted advertising, or offering delivery or support in the region. This mirrors the "directing activities" line of CJEU case law under the Brussels regime, in Pammer and Hotel Alpenhof.
So a genuinely domestic US product that one German developer happens to find and sign up for is in a different position from a product with a Europe page, euro pricing and a Berlin-timezone support rota. Note how narrow this actually is in practice: most SaaS companies with a self-serve trial are targeting a global market by design, and the moment you accept EU signups as a matter of course you have answered the question. It is also a poor foundation for a compliance position, because it depends on continuing not to want the customers.
Which Lawful Basis Fits A Trial
The absence of payment does not mean the absence of a contract. A trial user has accepted your terms of service, which is a contract, so Article 6(1)(b) is generally available for the processing necessary to provide the trial: account creation, authentication, delivering the product, support.
Where teams overreach is everything else. Product analytics, behavioural scoring, sales outreach and enrichment are not necessary to perform the trial contract, and stretching 6(1)(b) to cover them is a common and visible error. Legitimate interests under 6(1)(f) is usually the right basis for analytics and follow-up, provided you have done and documented the balancing test. Non-essential cookies and similar tracking have their own consent requirement under the ePrivacy rules regardless of which GDPR basis you rely on.
The signup form itself deserves a moment. Work email addresses collected at signup are personal data, which is straightforward but has consequences for what you can do with them afterwards, as our article on work email addresses sets out. If you enrich those signups from a data vendor, Article 14 applies and you owe the person information you did not have to give when they typed the address in themselves.
Beta Programmes Raise Sharper Questions
Betas are where the assumptions get riskier, because the informality of the arrangement is mistaken for informality in the obligations.
Beta software typically collects more than production software: verbose telemetry, session recordings, crash dumps with fuller context, feedback forms. Each is processing that needs a basis and a retention period, and "we needed the data to fix bugs" is a purpose, not a lawful basis.
Two specific traps recur. Beta participants are often told their feedback will be used to improve the product, which is fine, and are then quoted in marketing, which is a different purpose requiring its own basis. And betas frequently run on non-production infrastructure with weaker access controls, which is an Article 32 problem rather than a lawful basis one, and the same family of risk as copying live records into a staging environment.
A free beta with EU participants is also a service offering under Article 3(2)(a). If you have no EU establishment, that can be the thing that triggers the representative requirement discussed in our article on Article 27.
What Happens When The Trial Ends
This is the operational question, and the one most teams have never answered deliberately.
Storage limitation under Article 5(1)(e) means personal data must be kept no longer than necessary for the purposes it was processed for. When a trial expires without conversion, the purpose that justified most of the processing has ended. The account, its contents, the telemetry and the enrichment data all need a decided retention period.
The default in most products is indefinite, because nobody chose otherwise and deleting things is work. That is not a position you can defend, and it accumulates: a product with a popular free trial can hold more personal data about people who never became customers than about those who did.
Sales follow-up complicates it, legitimately. Retaining a lapsed trial contact for a defined period on a legitimate interests basis is often defensible; retaining it for six years because the CRM has no expiry field is not. Pick a period, write down why, and automate it, which is what automated retention cleanup is for.
Common Mistakes With Free Trial And Beta Users
Believing unpaid users are out of scope. Article 3(2)(a) applies irrespective of whether payment is required. This is the misconception the wording was written to prevent.
Stretching contractual necessity across everything. Article 6(1)(b) covers processing needed to deliver the trial. Analytics, scoring and outreach need their own basis, usually legitimate interests with a documented assessment.
Keeping expired trial data indefinitely. Storage limitation applies from the moment the purpose ends. Unconverted trials are the largest pool of undecided retention in most SaaS products.
Treating beta participants as informal collaborators. Enthusiasm is not consent, and a Slack channel is not a lawful basis. Betas usually collect more data than production, not less.
Assuming a free tier does not trigger the representative requirement. If Article 3(2) reaches you and you have no EU establishment, a free product can be exactly what puts you in scope.
FAQ
Does GDPR apply if we do not charge users anything?
Yes. Article 3(2)(a) covers the offering of goods or services irrespective of whether payment is required, and the definition of personal data does not depend on a commercial relationship. Free products, trials and betas all fall within scope on the same terms as paid ones.
Do trial users have the same rights as paying customers?
Yes, in full. Access, rectification, erasure, portability, objection and the rest apply identically. A trial user can submit an access request the day after signing up, and the one-month response clock runs exactly as it would for a customer.
How long can we keep data from an expired free trial?
As long as you have a purpose that justifies it, and no longer. Sales follow-up on a legitimate interests basis for a defined period is often defensible; indefinite retention because nobody set an expiry is not. Decide the period and automate its enforcement.
Do we need consent to email trial users about the product?
Not necessarily. Service messages about the trial itself are part of delivering it. Marketing messages are a separate purpose with their own rules under both GDPR and the applicable electronic communications regime, which differ depending on the recipient and the market.
Closing Thought
The reason this question persists is not that the law is ambiguous, because on this narrow point it is unusually clear. It persists because free users feel like a different category commercially, and it is easy to let a commercial intuition harden into a legal assumption nobody checked.
The more awkward observation is what the answer implies about volume. A product with a generous free tier probably holds personal data on far more people who never paid than people who did, distributed across analytics, CRM and telemetry systems that were built for growth rather than deletion. ComplyDog hosts a compliance portal on your own domain with self-serve data subject request handling, your subprocessor list and your security page, which matters more when the requests can come from anyone who ever signed up. It does not decide your retention periods, which is the part that needs a human to make a call.
