GDPR for MENA-focused SaaS: what actually matters
Most GDPR guides are written for EU-headquartered companies. Here is what changes when your SaaS is built in Lebanon, serving customers across MENA and Europe.
The asymmetry nobody talks about
GDPR applies to any company that processes personal data of EU residents — regardless of where the company is based. A Lebanese SaaS serving German customers is in scope. But the enforcement asymmetry is real: a Lebanon-incorporated company faces different practical risk than a Berlin-incorporated one.
This is not legal advice. It is what we learned building a customer conversation platform that handles messages from EU residents on behalf of tenants based across MENA and Europe.
Data processing agreements (DPAs)
If your tenants serve EU customers, you are a data processor. Your tenants are controllers. You need a signed DPA with every tenant before they can lawfully use your product with EU personal data.
We ship a standard DPA as a document that tenants can sign (wet or electronic). It specifies: what we process, the purpose, the sub-processors we use, and the technical measures we have in place. Keeping the sub-processor list current (updated when we add a vendor) is an ongoing operational task, not a one-time checkbox.
Data residency
EU enterprise customers increasingly ask: "where is our data stored?" The only answer that survives due diligence is one you can point at a deployment for. Ours is a single-region deployment in the United States, documented in the DPA and in the sub-processor list, with EEA/UK transfers resting on the Standard Contractual Clauses. We do not offer an EU-only or MENA-only processing option, and saying otherwise before a second region exists is the mistake this section is here to warn you about: a residency promise is one of the few claims a customer can put in a contract, and the first thing their auditor asks for is evidence.
Retention and deletion
The GDPR right-to-erasure means: when a tenant requests deletion of a user's data, we need to delete it — not just mark it as inactive. We built a GDPR cascade: deleting a contact triggers deletion of all conversation history, AI message logs, file attachments, and billing records for that contact. We test this in CI to prevent regressions.
What we do not claim
There is no "GDPR certification" scheme — we describe our controls as "GDPR-oriented" and note that our DPA is available for all paid plans. Our SOC 2 audit has not completed yet; we say "SOC 2 roadmap: audit in progress." These distinctions matter for the legal review teams at enterprise customers.
The practical advice: get a DPA template reviewed by counsel early, maintain your sub-processor list actively, and build deletion as a first-class operation rather than a backfill you do when someone asks.