GDPR compliance has become a standard item in Series A due diligence. Investors, particularly those operating in the EU or investing in EU-facing companies, now routinely review data protection practices alongside financial statements and employment agreements. Companies that cannot demonstrate compliance risk deal delays, price adjustments, or conditions precedent requiring remediation.
This article covers what investors check, what founders need to have ready, and how to prepare.
Why GDPR Features in VC Due Diligence
Material liability risk. GDPR fines of up to 4% of global annual turnover are a real liability for a portfolio company. Investors acquiring a stake in a non-compliant company acquire a proportional stake in that liability. For a SaaS company processing significant volumes of EU customer data, GDPR exposure is a material risk.
Customer contract risk. Enterprise customers increasingly require GDPR-compliant vendors. A company without a functional DPA offering, or with known compliance gaps, faces churn risk from enterprise customers who complete their own vendor reviews.
Regulatory scrutiny. Post-investment, portfolio companies often attract more attention — from customers, media, and regulators. A company that was below the radar pre-funding becomes visible post-funding.
What Investors Check in Due Diligence
The depth of GDPR review varies by investor. Specialist EU VC and growth-stage funds with EU portfolios may conduct detailed review. Early-stage and US-focused investors may conduct lighter-touch assessment. Common review areas:
Documentation review:
- Does the company have an Article 30 Records of Processing Activities (RoPA)?
- Is there a current privacy policy/notice on the website?
- Does the company have a DPA/Data Processing Addendum for customer contracts?
- Has a DPIA been conducted for high-risk processing activities?
Technical practices:
- Are international data transfers addressed (SCCs, DPF)?
- Does the company use a cookie consent management platform with records?
- Is there a documented breach notification procedure?
- Are security measures appropriate to the data being processed?
Organisational readiness:
- Is there an identified DPO or privacy lead (if required)?
- Has the company received any supervisory authority inquiries or complaints?
- Has there been any data breach, and if so, was it handled correctly?
Customer contract review:
- Are DPAs in place with all significant customers?
- Are DPAs technically compliant (covering all Article 28 requirements)?
- Are sub-processor lists maintained and customer notification procedures documented?
What Founders Need Ready Before Diligence Starts
The essentials (every company must have these):
- Written RoPA covering all processing activities
- Current, accurate privacy notice on the website
- DPA template (or signed DPAs with major customers)
- International transfer documentation (SCCs for US vendors)
- Cookie consent implementation with logged consent records
The differentiators (show maturity):
- A completed DPIA for any high-risk processing
- A documented breach response procedure
- A sub-processor list with transfer mechanisms
- Evidence of the last internal privacy review or audit
- Clean response to any prior supervisory authority correspondence
Common Findings and How to Fix Them
No DPA available. Customers ask for it; investors ask for it. Build a standard DPA and publish it. If you have enterprise customers without a DPA, execute one before diligence.
Privacy notice not updated since early product days. The privacy notice describes how data is processed. If the product has changed and the notice has not, there is a material gap. Update it.
US transfers not addressed. Using AWS, Stripe, Google Analytics, HubSpot, Intercom, or any other US SaaS without documented transfer mechanisms (SCCs or DPF) is a finding in every sophisticated due diligence. Address it before the data room is opened.
No breach notification procedure. The absence of a documented procedure suggests the company would not know how to respond to a breach. This is a red flag for technically sophisticated investors.
Consent cookie banners not implemented correctly. Running Google Analytics without valid cookie consent is a known, documented violation across EU member states. Investors may check this themselves — it is one of the most visible and easily auditable aspects of GDPR compliance.
The Due Diligence Data Room
In a typical data room structure, GDPR documentation appears in the legal section alongside employment contracts and IP assignments. Prepare a subsection labelled "Data Protection" containing:
- Article 30 RoPA
- Current privacy notice (or link to website)
- Standard DPA / Data Processing Addendum
- Sub-processor list
- International transfer documentation (SCC execution confirmation for major vendors)
- DPIA(s) if conducted
- Breach notification procedure
- Any supervisory authority correspondence
Having these documents ready accelerates the process. Not having them ready signals that they do not exist — which is the real risk.