Data protection for
technology companies

It depends on the business model and the specific processing activity. When a SaaS product processes its clients' customers' data exclusively on their instructions, it may act as a data processor (art. 28 GDPR). When it collects and uses data for its own purposes (usage analytics, product improvement), it acts as a data controller. Many technology companies are both, depending on the processing activity, and some relationships may be configured as joint controllership. The exact legal status must be analysed on a case-by-case basis.

Sub-processors are vendors to whom the data processor sub-contracts part of the processing of its clients' data. For example, a SaaS company that uses AWS or Google Cloud to host its clients' data must notify those clients of these sub-processors and have a Data Processing Agreement (DPA) with each one. The list of sub-processors must be public or accessible to clients and kept up to date.

International data transfers to the United States require adequate safeguards. Since July 2023 the EU-US Data Privacy Framework (DPF) has been in place, but its applicability depends on whether the recipient organisation is certified. For non-certified organisations, the European Commission's Standard Contractual Clauses (SCCs) are one of the available mechanisms. In any case, each transfer must be analysed individually with specialist advice.

Art. 25 GDPR establishes the principle of privacy by design and privacy by default, which applies to those who develop digital products or services. In practice, this means integrating data protection into technical decisions from the outset and configuring products with the most restrictive options by default. The AEPD has published specific guidance on how to apply this principle, which is worth consulting.

Yes. If the company acts as a data processor and suffers a security breach affecting its clients' data, it must notify the data controller (the client) without undue delay and, pursuant to the DPA, within the agreed timeframe (usually 24–72 hours). The data controller is responsible for notifying the AEPD within 72 hours if required.

Yes. Cookies used to analyse user behaviour within the platform (session recording, heatmaps, funnel analytics) using tools such as Hotjar, FullStory or Mixpanel require prior user consent. Even though the purpose is to improve the product, processing browsing data with these tools is not technically necessary to provide the service.