GDPR for MENA-focused SaaS: what actually matters
Most GDPR guides are written for EU-headquartered companies. Here is what changes when your SaaS is built in Lebanon, serving customers across MENA and Europe.
The asymmetry nobody talks about
GDPR applies to any company that processes personal data of EU residents — regardless of where the company is based. A Lebanese SaaS serving German customers is in scope. But the enforcement asymmetry is real: a Lebanon-incorporated company faces different practical risk than a Berlin-incorporated one.
This is not legal advice. It is what we learned building a customer conversation platform that handles messages from EU residents on behalf of tenants based across MENA and Europe.
Data processing agreements (DPAs)
If your tenants serve EU customers, you are a data processor. Your tenants are controllers. You need a signed DPA with every tenant before they can lawfully use your product with EU personal data.
We ship a standard DPA as a document that tenants can sign (wet or electronic). It specifies: what we process, the purpose, the sub-processors we use, and the technical measures we have in place. Keeping the sub-processor list current (updated when we add a vendor) is an ongoing operational task, not a one-time checkbox.
Data residency
EU enterprise customers increasingly ask: "where is our data stored?" We process data in AWS eu-west-1 by default. We document this in the DPA and in our sub-processor list. For tenants who need data to stay in-region, we have an EU-only processing option at the Enterprise plan.
Retention and deletion
The GDPR right-to-erasure means: when a tenant requests deletion of a user's data, we need to delete it — not just mark it as inactive. We built a GDPR cascade: deleting a contact triggers deletion of all conversation history, AI message logs, file attachments, and billing records for that contact. We test this in CI to prevent regressions.
What we do not claim
There is no "GDPR certification" scheme — we describe our controls as "GDPR-oriented" and note that our DPA is available for all paid plans. Our SOC 2 audit has not completed yet; we say "SOC 2 roadmap: audit in progress." These distinctions matter for the legal review teams at enterprise customers.
The practical advice: get a DPA template reviewed by counsel early, maintain your sub-processor list actively, and build deletion as a first-class operation rather than a backfill you do when someone asks.