Working documents for European DPOs, procurement leads, and compliance teams evaluating SaaS. Each guide is written from the buyer's side of the table, focused on what to verify, what to push back on, and what's typically negotiable.
How to run a defensible Transfer Impact Assessment on a SaaS vendor under Schrems II — what regulators expect, what vendors will and won't give you, and where the practical pressure points are.
A clause-by-clause checklist for reviewing a SaaS vendor's Data Processing Agreement under GDPR Art. 28 — what is required, what is negotiable, and what the common red flags look like.
How to track, vet, and respond to sub-processor changes from your SaaS vendors — without drowning in update emails. Covers notification handling, objection workflow, and how to spot the changes that actually matter.
Vendors use 'EU data residency' and 'data sovereignty' interchangeably, but they are not the same thing. A buyer's guide to what each term means, what it protects against, and what it doesn't.
A structured framework for deciding when to replace a US SaaS vendor with a European alternative — covering compliance gains, switching costs, feature gaps, and the categories where the trade-off is most favourable in 2026.