How to keep your apps compliant
Hey,
Since a friend of mine is working on a health SaaS, and he is concerned about compliance, i decided to write this.
Hope you like it and lmk what you think!
Here is a step-by-step guide on how to become GDPR compliant:
-Recognize the obligations of the GDPR.
The first step in complying with GDPR is to comprehend the requirements.
The GDPR governs the collection, use, and storage of personal data by businesses.
Any information that may be used to identify a real person, such as a name, email address, or phone number, is considered personal data.
According to GDPR, you must:
-
Prior to collecting data from data subjects, be sure you have their express, informed consent.
-
Just gather personal information that is required for the processing purpose.
-
Provide users the ability to see and request the erasure of their personal data
-
Adopt suitable security measures to safeguard personal information
-Perform a data audit
-If you are familiar with GDPR standards, conduct a data audit to determine the personal data your SaaS company collects, uses, and keeps.
-This information consists of facts about your partners, clients, and staff.
-Create a list of the categories of personal data you gather and the locations where it is kept.
-You may use this to find any potential GDPR compliance holes.
-Update your privacy policy and terms of service
-
You should modify your terms of service and privacy policy to comply with GDPR standards.
-
Make sure your privacy policy is straightforward to comprehend and explains how you gather, use, and retain personal information.
-
Furthermore included should be a description of data subjects' rights and how to exercise them.
-
Your terms of service should stipulate requirements for GDPR compliance.
-
Obtain consent from data subjects
- When collecting a data subject's personal information, you must get their explicit, informed consent in order to be in compliance with GDPR.
- Make sure that your permission forms are simple for data subjects to withdraw their consent at any moment, and that they are clear and unambiguous.
That's mostly it! There are a few more steps that are more or less optional.
If you need help with compliance or have any questions, you can find us here:https://getsafesaas.co and we are happy to help!
If you're working on a health sector app, you will have to comply with more than just GDPR. The exact types of regulations and compliance will depend on what aspect of the health sector you are related to, as well as the jurisdiction.
For example, in the USA this could include HIPAA Privacy and Security, and in the UK, Software as a Medical Device (SAMD).
This right here, HIPAA and SAMD are much more important than GDPR for the service itself. As a service provider you may not be able to export/store the health data from the customer's country. Let's say from an EU country to the US. Others maybe fine, like some of the Common Wealth to the US as long as your HIPAA compliant. If you can't have EU customers and don't target them, because you aren't compliant with their PHI requirements, then GDPR becomes less important or not even needed:
According to Recital 23: foreign companies are required to comply with the GDPR only if they target EU residents with their marketing.
100% agreed, thanks for the additions, my friend already has someone looking into HIPAA and i was only needed for the GDPR part. I will do a post for HIPAA soon.
When your SaaS solution is in such a heavily regulated industry and you are not familiair with the regulatory aspects, or all of the regulatory aspects....I would recommend you get extra (legal) help. GDPR is nothing and it's quite standard + within EU it applies for everything regarding user data.
Two of these types of industries would be healthcare and finance.
What I can tell you from experience; I used to work on a startup which was in the payments and money transfer business. In this case the solution would store money from the users temporary in a secured wallet (not crypto though), after which they could use it for later or request refund. This specific functionality had a lot of legal implications, which also meant that we had to adhere to security regulation mandated by the countries central bank and we also had to be registered and approved by the countries central bank.
Since we were a small start-up and didn't have the funds to get a big legal firm to help us in doing this, we had to find an independent consultant in this field, who in turn had the right background. He advised us on what to do to be compliant and we basically did the work and implemented the necessary regulations.
This might also be an approach you could take, which I would recommend. Since healthcare is a very tricky industry.
Agreed, HIPAA and such are so much more important, i only had to do the gdpr for him. Btw what happen with your payment and money transfer startup?
Unfortunately we had to pull the plug. It was a solution for events (festivals, clubs etc). Eventually a lot of potential clients showed interest, but getting them to a point of actually paying for it became very challenging.
The solution was good for the enduser, but the client was the actual promotor/event organizer, and they were not that eager.
Sounds great!
Thanks!
Great article Adrian, I will make sure to check if my saas, Affistash.com is compliant
Thanks, Vic!