ComplyDog Blog

SCCs are a contract you sign today. BCRs are an internal rulebook a regulator must approve. For almost every SaaS, only one of those is realistic.

Posted by Kevin Yun | 2026-09-02T08:12:35.177Z

If GDPR reaches you through Article 3(2) and you have no EU establishment, you probably need one. The exemption is narrower than most companies hope.

Posted by Kevin Yun | 2026-09-02T08:10:16.674Z

Three tiers, £52 to £3,763, and a set of exemptions that almost no SaaS qualifies for. Here is how the tiers actually work and who has to pay.

Posted by Kevin Yun | 2026-09-01T00:00:00.000Z

GDPR does not require insurance, and a policy probably cannot pay your fine. What it does cover is the part that actually bankrupts small companies.

Posted by Kevin Yun | 2026-09-01T00:00:00.000Z

If it identifies a person, yes, and who pays for the mailbox is irrelevant. The line falls between named individuals and genuinely generic addresses.

Posted by Kevin Yun | 2026-08-31T19:03:08.429Z

For most website and SaaS operators, yes. The Court of Justice settled it in Breyer, and the test is what you could reasonably do to identify someone.

Posted by Kevin Yun | 2026-08-31T19:00:52.350Z

An NDA is a private promise about secrecy. A DPA is a statutory requirement under Article 28. One cannot do the other's job, and most deals need both.

Posted by Kevin Yun | 2026-08-30T18:03:11.524Z

Neither term appears in the GDPR. The law requires specific information under Articles 13 and 14, and the label you put on it is your choice.

Posted by Kevin Yun | 2026-08-30T18:01:21.814Z

Copying production data to staging is processing for a new purpose. It needs a compatibility assessment, and staging rarely has the controls to justify it.

Posted by Kevin Yun | 2026-08-29T18:02:53.132Z