Here’s the sentence that trips up more US founders than anything else in this series: GDPR
doesn’t care where your office is. A SaaS company headquartered in Austin or New York,
with no EU entity at all, is still squarely inside GDPR’s scope the moment it processes
personal data belonging to people in the EU — through a customer, a website visitor, or a
support ticket. Most founders find this out reactively: an enterprise buyer in Munich asks
for a GDPR compliance statement before signing, or a data subject complaint arrives from a
country they don’t have an office in.
Note on sourcing: The primary example below is Open Access BPO, a real multilingual
outsourcing company, documented in their own published announcement with named
quotes from their Information Security Manager and CEO, and a named accredited auditor.
It’s cited and linked throughout. This is not a B4Q client engagement — it’s included
because it’s a clear, verifiable example of what a real GDPR compliance process looks like
end to end, including the audit partner most compliance content leaves out.
The Company: Open Access BPO
Open Access BPO is a multilingual business process outsourcing firm supporting global
companies and their customers, including clients across the EU. As a company processing
personal data on behalf of other businesses — a data processor, in GDPR’s specific
vocabulary — their compliance posture wasn’t just their own risk; it was something every
one of their EU-facing clients needed to be able to point to when justifying their own
compliance.
The Problem: A Regulation That Reaches Into Product, Support, and Vendor Management
GDPR compliance is rarely a pure legal or paperwork exercise, and this is where a lot of US
SaaS teams underestimate the lift. It reaches into product design, analytics, customer
support, security operations, and vendor management simultaneously. For a company
processing data continuously across application logs, support tickets, billing systems, and
cloud infrastructure, the practical challenge isn’t understanding GDPR’s seven principles in
the abstract — it’s proving, systematically, that every one of those data flows is actually
covered.
Open Access BPO’s specific version of this problem: as a BPO handling personal data on
behalf of client companies, their processes for collecting and processing that data needed a
real privacy framework behind them, not just a stated policy. That meant designing a
program from the actual mechanics of how data moved through their operations, not
retrofitting a template.
What the Stakes Actually Look Like
The numbers here are worth stating plainly, because they explain why this isn’t optional
risk management for a company with any EU exposure. GDPR fines can reach up to 4% of a
company’s global annual turnover — not a flat cap, a percentage of total worldwide revenue.
In 2023, EU regulators fined Meta €1.2 billion specifically over unlawful data transfers to
the US, a case that made clear even a company with effectively unlimited legal resources
isn’t exempt from enforcement. And the operational cost of a breach compounds the
exposure: the average cost of a US data breach now sits at $10.22 million, meaning a GDPR
fine on top of an actual breach isn’t a hypothetical double penalty — it’s the realistic worst
case for a company that gets this wrong.
There’s a specific, frequently missed requirement worth calling out directly: under GDPR
Article 27, most companies outside the EU and UK that process EU or UK personal data are
required to appoint a local representative — a named point of contact for regulators and
data subjects. Many US SaaS founders have never heard of this obligation, assuming that
having no EU office means having no EU representative requirement. It doesn’t work that
way, and increasingly, enterprise customers in finance, healthcare, and the public sector
specifically ask vendors to demonstrate Article 27 compliance as part of procurement.
What Open Access BPO Actually Did
Open Access BPO partnered with Network Intelligence, a global cybersecurity solutions
firm, to serve as their GDPR auditor — a named, real accredited assessor, not an internal
self-certification. To prepare for the assessment, the company conducted a genuine
analysis of how customer data was actually being collected and processed across its
operations, alongside risk assessments and privacy impact evaluations specific to their
processing activities.
According to Open Access BPO’s Information Security Manager, Rovie Salvatierra, that
groundwork — the risk assessments and impact evaluations specifically — is what let the
company design a privacy framework that actually reflected how data moved through the
business, rather than a policy document disconnected from real operations. CEO Benjamin
Davidowitz framed the achievement as an extension of security practices the company says
it had already prioritized, rather than a one-off compliance sprint bolted on for the
occasion.
A Second Data Point: Merge
Merge, a company providing unified APIs for B2B SaaS organizations to add integrations to
their products, published its own account of European expansion explicitly tied to data
protection posture. As part of establishing a dedicated Berlin-based team to serve
European B2B SaaS customers, the company specifically cited GDPR as a top priority for
the European organizations it serves, and pointed to its existing ISO 27001 and SOC 2 Type
2 certifications as part of how it supports European companies’ own integration and
compliance needs. The pattern here is one that shows up constantly in this series: GDPR
compliance rarely stands alone — it sits alongside SOC 2 or ISO 27001 as part of one
coherent security and trust story, not a separate box to check.
The Result
For Open Access BPO, the published outcome is straightforward: formal GDPR compliance,
verified by a named third-party auditor, giving every customer touching EU personal data
through the BPO’s operations a documented basis for their own compliance claims. For
Merge, GDPR alignment functioned as table stakes for a genuine market expansion — the
Berlin office wasn’t just a sales presence, it was a signal to European customers that data
protection expectations specific to their market were being taken seriously at the
infrastructure level, not just the marketing page.
The Pattern Underneath Both Stories
1. A real auditor, not a self-assessment, is what makes the claim credible. Open Access
BPO’s use of Network Intelligence as a named, real cybersecurity firm mirrors the
pattern from every other framework in this series — the report or attestation only
carries weight when someone independent stands behind it.
2. GDPR compliance work has to start from actual data flows, not a template. The risk
assessments and privacy impact evaluations that shaped Open Access BPO’s
framework only worked because they mapped the company’s real operations, not a
generic checklist.
3. GDPR rarely travels alone. Merge’s story shows GDPR compliance bundled with ISO
27001 and SOC 2 Type 2 as one unified trust signal for European buyers — not a
separate, standalone certification most companies pursue in isolation.
4. Article 27 representation is a specific, commonly missed requirement, not a general
“have a privacy policy” obligation — and it’s increasingly something EU-facing
procurement teams check for directly.
What This Means If You're Facing This Right Now
If your SaaS company has any EU users, customers, or website traffic, the honest first step
isn’t a generic privacy policy rewrite — it’s a real data mapping exercise: where does EU
personal data enter your systems, where does it flow after that, and which of GDPR’s lawful
bases actually covers each of those flows. Only after that mapping does an Article 27
representative, a Data Processing Agreement template, and a defensible response process
for data subject requests make sense to build.
B4Q’s approach for a company in this position starts with exactly that mapping work, then
layers GDPR requirements onto whatever SOC 2 or ISO 27001 program already exists rather
than building a parallel, disconnected privacy project — following the same pattern
Merge’s story illustrates, where the strongest position with European buyers comes from
one coherent security and privacy story, not three separate ones.
The Honest Caveat
Open Access BPO’s published case doesn’t include specific commercial outcomes — new
deals closed, revenue attributable to the certification — the way some of the SOC 2 stories
in this series do. The result is described in terms of the compliance achievement itself and
the internal process used to get there, and that’s worth being upfront about rather than
implying a sales metric the source material doesn’t actually report. GDPR’s return on
investment, similar to PCI DSS, often shows up more clearly as avoided catastrophic
downside — fines, breach liability, lost EU market access — than as an accelerated sales
number.