GDPR Package for IT Companies: Compliance for SaaS, Mobile Applications and AI Products
We will prepare GDPR documentation for SaaS platforms, mobile applications, AI services, and other digital products. We will examine how the company collects, uses, stores, and transfers personal data, determine the required scope of documentation, and tailor it to the product's actual operations
We will prepare GDPR documentation for SaaS platforms, mobile applications, AI services, and other digital products. We will examine how the company collects, uses, stores, and transfers personal data, determine the required scope of documentation, and adapt it to the product’s actual operations.
The package starts at EUR 950. The standard preparation time is 4 to 6 business days. One round of revisions is included in the price.
GDPR compliance for an IT company is not limited to having a Privacy Policy on its website. The requirements affect the product architecture, relationships with clients and contractors, the use of cloud services, analytics, data retention periods, and procedures for handling user requests or data breaches.
The documents must reflect how the product actually operates. If the Privacy Policy describes one process, while connected SDKs, CRM systems, servers, and payment services create a different data processing chain, merely having the document in place will not be sufficient.
When an IT Company Needs GDPR Compliance
The GDPR applies not only to businesses registered in the European Union. Its requirements may also apply to a company from another country if it specifically offers goods or services to people located in the EU, monitors their behavior, or processes data in the context of the activities of a European establishment.
Checking whether the GDPR applies is particularly important if the company:
- sells a SaaS product to clients in the EU
- launches a mobile application for the European market
- uses user accounts, subscriptions, email newsletters, cookies, or analytics
- processes user data on behalf of corporate clients
- integrates cloud platforms, CRM systems, AI models, and payment services
- undergoes due diligence by an investor or enterprise client
- receives a request to sign a DPA or complete a privacy questionnaire
The mere fact that a user from the EU happens to access the product does not always mean that the GDPR automatically applies to all of the company’s activities. The target market, product operating model, nature of processing, and the company’s role are important. Therefore, preparation begins with an analysis of the specific situation rather than copying a generic policy.
Why a Privacy Policy Alone Is Not Enough
A Privacy Policy explains to users what data the company collects and how it handles that data. However, this document does not replace internal procedures, agreements with processors, or records of personal data processing activities.
The company must understand the purposes for which each category of information is used, the legal basis for processing, who receives the data, and how long it is retained. It is also necessary to determine who responds to user requests, what happens to information after an account is deleted, and how the team acts when an incident is detected.
For SaaS companies, correctly determining their role is particularly important. The same business may act as a data controller for its own users and employees, a processor of a corporate client’s information, and simultaneously engage cloud services as subprocessors. This determines the content of the DPA, records of processing activities, user notices, and agreements with providers.
How We Prepare GDPR Documentation
Before drafting the documents, we collect information about the product and the flow of data within it. We analyze user registration and authentication, contact forms, subscriptions, payments, analytics, advertising tools, technical SDKs, and other integrations.
We also determine where servers and backups are located, which contractors have access to information, which countries they operate in, and what happens to the data after a contract ends or an account is deleted. If the product uses profiling, automated decision-making, special categories of data, or information about children, these processes are reviewed separately.
This approach allows us to prepare a consistent set of documents. The Privacy Policy, Cookie Policy, DPA, and ROPA must describe the same actual processing model rather than exist as independent templates.
What Is Included in the GDPR Starter Pack
The Standard package is available for most IT products. The Extended package is suitable for projects involving more complex processing or higher risks.
| Document or Procedure | Standard | Extended |
| Privacy Policy | Yes | Yes |
| Cookie Policy | Yes | Yes |
| Recommendations for the Consent Mechanism | Yes | Yes |
| Privacy Notice for Employees and Contractors | Yes | Yes |
| Basic Record of Processing Activities (ROPA) | Yes | Yes |
| DPA Template | Yes | Yes |
| DPIA Template | — | Yes |
| Legitimate Interests Assessment | — | Yes |
| Data Breach Response Procedure | — | Yes |
| Price | 950 EUR | 1,200 EUR |
Standard — Basic GDPR Infrastructure
The Standard package is designed for SaaS platforms, applications, and digital products that primarily process ordinary personal data.
The Privacy Policy is adapted to the methods of data collection, user categories, processing purposes, and integrated services. The Cookie Policy describes the technologies and providers used, while recommendations for the consent mechanism help align the legal documents with the website or product interface.
The privacy notice for employees and contractors covers the processing of team members’ data. The basic ROPA organizes processing activities, purposes, categories of information, recipients, and retention periods. The DPA template is prepared taking into account the company’s role and its expected relationships with clients, processors, or subprocessors.
The Standard package costs 950 EUR.
Extended — For Higher-Risk Processing
The Extended package is suitable for products that use special categories of data, large-scale monitoring, complex profiling, automated decision-making, or other processes that may create increased risks for users.
This may be relevant for certain projects in digital health, fintech, HR-tech, artificial intelligence, and biometric identification, as well as products aimed at children. However, financial data and information about children are not classified as special categories under Article 9 of the GDPR, although the nature of their processing may require additional safeguards.
In addition to the Standard documents, the Extended package includes a DPIA template, a Legitimate Interests Assessment (LIA), and a personal data breach response procedure.
The Extended package costs 1,200 EUR.
The presence of AI features, financial data, or special categories of information does not mean that a DPIA is automatically required for every product. The nature, scale, and purposes of processing, as well as the potential consequences for users, are important. The appropriate package is determined after reviewing the project.
What the Client Receives
Upon completion, the company receives a consistent set of GDPR documents prepared based on the information provided about the product. The final versions are delivered in Word and PDF formats, together with recommendations on their publication and use.
The price includes one round of revisions after receiving the client’s comments. If necessary, we explain the key provisions of the documents and indicate what actions will be required from the product or technical team.
The documentation reflects the state of the product at the time of preparation. If the company integrates a new provider, launches an additional feature, starts collecting other categories of data, or enters a new market, the documentation must be reviewed.
Which Tasks Are Not Included in the Basic Package
The Starter Pack establishes a basic documentation framework, but some projects require more in-depth work. For example, when transferring data outside the EEA, Standard Contractual Clauses and an analysis of the specific transfer chain may be required. Other separate tasks may include an individual DPIA, a review of supplier agreements, preparation of a procedure for handling user requests, or an assessment of the need to appoint a DPO and an EU representative.
Technical implementation of a cookie banner and consent management system is also not automatically included in the basic package. The Starter Pack includes a Cookie Policy and recommendations on the legal framework of the consent mechanism. The scope of technical work, if required, is agreed separately.
A separate service arrangement will also be required in the event of an existing data breach, a regulatory investigation, or receipt of an extensive privacy questionnaire from a corporate client.
How the Process Works
1
Initial Consultation. We discuss the product, users, target markets, and the company’s objectives. We determine whether the Starter Pack is suitable and which level is required.
2
Information Collection. The client completes a questionnaire about data categories, product features, providers, user geography, and internal processes.
3
Processing Analysis. We determine the company’s role, main processing activities, processors involved, and potential risk areas.
4
Document Preparation. We develop the documents in parallel to ensure that their provisions are consistent with one another and with the product’s actual operations.
5
Review and Delivery. We receive comments, make one round of revisions, and deliver the final versions in Word and PDF formats.
The work usually takes 4 to 6 business days after receiving complete information. If the product has a complex architecture or requires additional documents, the timeline is agreed separately.
GDPR for SaaS Platforms
A SaaS company often works with two streams of data. The first relates to its own users, employees, marketing, and sales. The second arises when a corporate client uploads data about its employees or customers into the system.
In such cases, it is important to distinguish the company’s roles, agree on DPAs with clients, review relationships with subprocessors, and establish procedures for returning or deleting information after the contract ends. International transfers, backups, and support staff access require particular attention.
Learn more: GDPR for SaaS Platforms and IT Services
GDPR for Mobile Applications
A mobile application may collect significantly more information than users see in the registration form. Processing involves analytics and advertising SDKs, push notifications, payment systems, crash reporting, and device permissions.
Legal documents must reflect how these tools actually operate, consent settings, and the information published in the App Store or Google Play.
Learn more: GDPR for Mobile Applications
GDPR for AI Products
When AI is used, personal data may appear in user prompts, system logs, training datasets, and model outputs. To prepare the documentation, it is necessary to understand whether the model provider stores prompts, whether they are used for training, who has access to the outputs, and whether information can be deleted at the user’s request.
If an AI feature is used for profiling or making decisions that may significantly affect an individual, an additional assessment of the legal bases and risks will be required.
Why Companies Choose Wolja Digital
We work with IT businesses and consider the GDPR not in isolation, but in connection with the product, contracts, and business model. This allows us to align public-facing policies with the DPA, records of processing activities, and the actual chain of service providers.
The objective of the project is to prepare a set of documents that the company can use when launching a product, negotiating with clients, engaging contractors, and undergoing legal due diligence.
FAQ
Yes, if the product serves users in the EU or processes their personal data.
A DPA is a data processing agreement between a company and a contractor that has access to users’ personal data.
A DPIA is generally required when processing special categories of data, using automated decision-making, or carrying out processing activities that pose increased privacy risks.
In most cases, no. SaaS platforms and applications typically require a comprehensive set of GDPR documents and procedures.
Yes. The package is tailored to SaaS platforms, mobile applications, and other IT products depending on their data processing model.
A DPA is required when one party processes personal data on behalf of another. For a SaaS company, this may be an agreement with a corporate client or a contract with an engaged processor or subprocessor.
No. A DPIA is required if the planned processing is likely to result in a high risk to the rights and freedoms of individuals. The use of AI is an important factor in the assessment, but it does not automatically make a DPIA mandatory in all cases.
The Starter Pack includes a Cookie Policy and recommendations on the legal requirements for consent. Technical implementation on the website or in the application is agreed separately.
The package establishes a basic documentation framework. However, GDPR compliance is an ongoing process: the company must implement the documents in practice, follow the established procedures, and update the documentation whenever the product or supply chain changes.
There is no single mandatory certificate that automatically confirms a company’s full compliance with all GDPR requirements. The outcome of our work is a set of documents and procedures tailored to the specific data processing model.
The Standard package costs EUR 950, while the Extended package costs EUR 1,200. The standard preparation time is 4 to 6 business days after receiving all the required information. Additional tasks are priced separately.
Associated Services:
We Will Prepare GDPR Documents Tailored to Your Product’s Actual Operations
Tell us how your SaaS service, mobile application, or AI product works. We will examine your data processing model, determine the appropriate package level, and prepare documents tailored to your company’s processes.
The initial consultation is free of charge.