In the European SaaS software market, your marketing and sales activities must meet mandatory legal and other requirements, including copyright rules and the General Data Protection Regulation (GDPR). With strong IT and SaaS competition, particularly in Germany, the United Kingdom, Spain, France and Poland, you should focus on your core capabilities and the quality of your services rather than competing on cost alone. Specialising in particular industries can also help reduce competition.

Requirements for SaaS providers vary by country, industry and segment. The automotive industry, education, healthcare and the public sector, for example, have different industry-specific standards, rules and regulations. As it would be impossible to list every possible requirement, this article focuses on the most common ones.

Mandatory requirements to meet

Mandatory requirements for providing SaaS solutions within the European market can be divided into legal and non-legal mandatory requirements.

Legal requirements include legislation about copyright as well as personal data protection. Privacy is highly regulated and protected in Europe, via the General Data Protection Regulation (GDPR), introduced in 2018, and the ePrivacy Directive. Failure to comply may result in enforcement action or claims, even if your company is located outside the European Union. Non-legal requirements mainly concern security. Although compliance is not necessarily required by law, buyers may consider them minimum requirements for entering the European market.

Copyright

The European Union has introduced specific legislation to protect computer programs through copyright. Under the Directive on the legal protection of computer programs, you must ensure that placing your software on the market does not infringe copyright. At the same time, the Directive protects your own products against unauthorised copying.

GDPR – General Data Protection Regulation

The General Data Protection Regulation came into force on 25 May 2018. It was designed to protect individuals in Europe against privacy and data breaches and give people greater control over their personal data. It also enables businesses to benefit from a level playing field through common rules across European countries.

The GDPR applies to companies processing the personal data of individuals in Europe, regardless of where the company is located. This means it may also apply directly to your business if it is based outside the EU, for example in the United States, Thailand or Israel.

Under the previous Directive, the data controller was responsible for protecting information that could identify an individual. Under the GDPR, companies and individuals processing personal data also have responsibilities for its protection. Examples of personal data include names, email addresses, bank details, social media content, photographs and IP addresses.

Key rights and principles to consider include:

  • Consent: where consent is required, individuals must actively opt in. Consent must be easy to withdraw, and requests must be specific and written in plain language.
  • Right of access: individuals have the right to know whether a business processes their personal data, where processing takes place and for what purpose.
  • Right to be forgotten: individuals can request the deletion of their personal data and an end to its processing and sharing.
  • Privacy by design: data protection should be incorporated into systems from the outset. Data collection should be minimised and access restricted.

Not every software project or website involves personal data, but many do, particularly in the SaaS sector. As personal data becomes more important in software development, GDPR compliance becomes increasingly relevant to this industry.

ePrivacy Directive

The Directive on privacy and electronic communications (2002/58/EC), commonly known as the “Cookie Law”, sets specific rules for privacy in electronic communications. For example, it restricts unsolicited commercial email (“spam”), establishes strict rules for cookies and regulates the publication of contact details.

A new ePrivacy Regulation was originally intended to take effect alongside the GDPR, but its implementation was delayed. The proposal aimed to protect the confidentiality of electronic communications through stricter privacy rules and to include internet-based voice and messaging technologies such as Skype, WhatsApp and Facebook Messenger.

The proposed ePrivacy Regulation also explicitly addressed software development. Its scope was intended to cover providers of electronic communications services, publicly available directories, and software enabling electronic communications, including the retrieval and presentation of information on the internet.

Security

Data security is one of the biggest challenges facing SaaS and IT solution providers. This includes both data protection and recovery systems. Many European buyers expect an information security management system, particularly in sectors where security is critical, such as finance and banking, healthcare and mobile applications. The ISO 27000 family provides common standards and guidance for information security.

ISO 27001 is an internationally recognised standard setting requirements for an information security management system. Companies can obtain certification by meeting its requirements. ISO 27002 complements ISO 27001 with guidance and advice on implementing information security controls. Further supporting guidance in the ISO 27000 family includes ISO 27003 and ISO 27004. ISO/IEC 27701:2019 provides a certifiable privacy extension to ISO 27001 and supports GDPR-related privacy management.