Ever since the expansion of internet usage in modern human lives, data privacy has become one of the major concerns for individuals. We login to several sites, browse several web pages and share our details in various web portals without the least idea of how those data can be used to our advantage or disadvantage. Hence, to protect the privacy of our data several nations’ governments have come up with their own legal frameworks to which every company operating in their territory must comply.

General Data Protection Regulation is one such regulation in European law which was brought forth in 2016 to implement data privacy and protection for every citizen of European Union (EU). It is considered as a last successor of the Data Protection Directive which was introduced in 1995 when the internet was in its initial days of operation.

GDPR for SaaS providers requires SaaS businesses to protect the privacy of European citizens who are doing any kind of transactions with them within the boundaries of EU member states. The companies that fall under such categories are mostly, but not limited to, the banks, insurance providers and financial services because they are the ones who deal most with the
data of the citizens.

Why GDPR

With more and more companies dealing with massive amounts of data ever since the boom of digital age in the last decade (to be specific somewhere around 2005), the cyber attackers have been presented with the greater opportunities to expose millions of records of the companies’ customers that are dealing with their private information.

It has been reported that more than 4,500 data breach cases have occurred since 2005 with more than 800 million records being stolen by the cyber attackers. And it was estimated in a 2012 report by CSC that by 2020, over one-third of all data will be stored or transacted through the cloud.

If so much information is being transferred through digital channels then a need for a data protection regulation can hardly be overemphasized.

Training deck for GDPR

At SmartKarrot, we have been able to integrate the GDPR laws with our platform to ensure our clients’ data security and privacy are being taken care of. Since we learnt a lot while implementing these changes to our system, we thought of sharing those learnings with the SaaS community so that other companies who are on their way to GDPR compliance do not have to start from scratch.

Hence, with an intention to provide you with online help material to get started on GDPR compliance, we have created this training deck for your staff that will briefly give you an idea of what GDPR is and how you can apply it to your own systems.

You can download your free copy from here.

GDPR Quiz

Once you and your team have gone through our GDPR training material and other resources provided in this microsite, it would be wise to cross-check your knowledge on this subject through a trusted source. Hence, we have come up with a short quiz that will test your understanding of GDPR and will help you gauge whether you have acquired the essential knowledge to proceed on implementing those changes to your system or not.

The tests are divided into two levels – intermediate and advanced. We prefer you start with the intermediate level and only if you score more than 80% in it should you jump on to the next level. And if you score less than 80% in intermediate level then you must spend some more time to gather knowledge about GDPR and prepare well before you take the advanced level test.
Here are the links to the two tests.

GDPR vs SOC2 vs HIPAA

GDPR, SOC2 and HIPAA are the compliance frameworks built for the companies dealing with their customers’ data to ensure their data security and privacy in the digital world are in place. Although they were introduced to cover the similar aspects of data security, they have their own differences because of which they are applicable to different types of organizations and sometimes to the same organization too.

GDPR is made by European Parliament and the Council of the European Union while SOC2 was introduced by American Institute of Certified Public Accountants (AICPA) and HIPAA was issued by The U.S. Department of Health and Human Services (HHS). GDPR is legally enforceable and applies to all the organizations in the world that are dealing or processing the personal data of EU citizens. Whereas SOC2 is not legally enforceable and primarily applies to the organizations operating in the US. And HIPAA privacy rules are applicable specifically to the individual’s health information termed as “Protected Health Information (PHI)”.

If you want to go into the details of the differences between these three compliance standards then you may refer to this article.

GDPR Resources

“The History of the General Data Protection Regulation”
Source: GDPR History

Before you begin to read about GDPR, it is good if you know a bit of its history and how it evolved from the “Data Protection Directive” which was adopted by European parliament and council in 1995. This article would give you the information about every stage of development in a timeline that finally led to the formation of GDPR.

“Why GDPR Compliance is Important”
Source: Importance of GDPR compliance

This article will give you the information about what happens if your company doesn’t comply with GDPR, the data that GDPR protects and things that you need to consider for this compliance.

“All about GDPR”
Source: GDPR wiki

If you want to know all the details about GDPR in a centralized knowledge base then what better source could there be than Wikipedia. This is a very comprehensive article on Wikipedia about GDPR and covers all the contents that you need to know before you start to aim for your company to comply with this law.

“Complete guide to GDPR compliance”
Source: EU’s official information for GDPR

This is an EU’s official library made to help companies doing research for GDPR compliance by providing them the most updated information on this topic. It will give you the sources from where you can get information about GDPR overview, compliance, news and update. It also includes a checklist which you can use to focus your efforts and know about the practical steps
you can take for compliance.

“Impact of GDPR on your business”
Source: How has GDPR actually affected businesses?

This article aims to provide a generic overview of the impact of GDPR to the businesses. It will also cover the aspects of how companies are responding to this law including the comments from the key members of those organizations. What they are doing and what remains to be done are few of the highlighted information in this article with a short glimpse of what the future holds for these kinds of regulations.

“Guide to running a GDPR compliant SaaS business”
Source: GDPR for SaaS

This is a very useful guide for those who are looking for specific areas in their SaaS business where this law needs amendment. It will guide you through all the steps where you will need to make changes to comply with GDPR like updating your terms of services, your website, your logs and error reporting and more. This article will help you gauge the volume of the work that is needed in your SaaS business to implement the changes related to GDPR.

“The Ultimate GDPR SaaS Checklist”
Source: GDPR SaaS Checklist

This is truly an ultimate checklist for your SaaS business that you can use to make sure you have covered all aspects of GDPR that are applicable to your business. It will start with giving you a list of rights of your customers that you need to protect and will expand onto the checklist of do’s and dont ’s of GDPR that you can directly correlate with your company. This is a very practical and easy to implement guide for the SaaS owners and is worth spending their time in considering the points mentioned here.

---