ComplyDog Blog

Usually yes for the part that touches the device, and that is a separate question from your lawful basis for the processing that follows.

Posted by Kevin Yun | 2026-09-08T14:55:48.944Z

The controller and the processor both do. In a B2B SaaS deal your customer signs yours, and you sign your vendors' — often on the same day.

Posted by Kevin Yun | 2026-09-06T15:58:42.261Z

Only vendors that process personal data on your behalf. That is fewer than every supplier and more than most SaaS companies assume.

Posted by Kevin Yun | 2026-09-06T15:52:33.064Z

For most B2B SaaS companies one accountable owner is enough. The regulation asks for accountability and evidence, not for headcount.

Posted by Kevin Yun | 2026-09-05T05:41:33.370Z

It depends on whether they work under your direct authority or as an independent processor. Employment status decides it, not the invoice.

Posted by Kevin Yun | 2026-09-05T05:39:51.789Z

Yes. Fixtures, env files, screenshots and build artefacts hold personal data, and git history makes deletion genuinely harder than elsewhere.

Posted by Kevin Yun | 2026-09-04T18:24:43.673Z

Yes. Internal dashboards hold the same personal data as your product, and they are the systems most often missing from a data map entirely.

Posted by Kevin Yun | 2026-09-04T18:23:20.759Z

Yes. Public availability does not make personal data non-personal, and scraping triggers an Article 14 duty to inform people within one month.

Posted by Kevin Yun | 2026-09-03T18:56:33.669Z

Yes, and the regulation says so in terms: Article 3(2)(a) applies irrespective of whether payment is required. Free users are data subjects too.

Posted by Kevin Yun | 2026-09-03T18:54:42.180Z