Data Protection Agreements with Customers
I have a SaaS. It collects personal data. I have a terms of service and a privacy policy. I explain what data is collected and how it's stored. A potential customer has sent me a lengthy "Data protection agreement" to sign. I understand I have no obligation to sign this agreement. I understand I do have to comply with GDPR et al no matter what I sign. Question is, when this same company subscribes to Office 365, are they sending Microsoft's legal department a DPA? I can't imagine they are. Also, if my SaaS grows, I will not have time to go through numerous proprietary contracts and comply with their request to provide them periodic updates on my service.
One very overbearing thing from this contract: They are to approve all my subcontractors and I have to submit for their approval 30 days prior to hire. There's no way a subscriber to my SaaS is going to have any insight or say in who I hire.
What the normal approach?
Hi Matt, I've set up this process at my company and its definitely a minefield, happy to take you through it if you like. In short, you should be providing a DPA to your customers as the vendor and they should agree it. This contract should be boilerplate, and you can pretty much reject any customer who wants to throw their legal dollars (and yours) at this. Its worth noting though as you move up market, this is simply the cost of doing business. At your price point, I'm very surprised you're coming up against this. Do you hold a lot of personal sensitive data?
Hi Bryce, I don't hold much personal data at all. Email address, usernames and names of private projects (from Jira, Github etc). I decided to just be upfront with this customer and say my legal counsel is paid by the hour. So it would probably cost me 8 years of my lowest subscription plan for ROI. So unless they are planning on using a higher price plan, it doesn't make sense for my business.
Is a DPA something that every customer agrees to like a TOS? Or I just offer it to companies who ask?
Hi Matt, for vendors who play in multiple regions, a lot don't build GDPR protections into their main T&C's, instead they provide them as an addendum which is opted into if required by the client. Given you don't appear to hold any special category data this is definitely an overreach by your clients. It might be growing pains, maybe they don't have a lot of trust in you at the buy stage.
To be honest, most GDPR q's I get go away once I can answer the first 1 or 2 with confidence. It might be worth throwing up a FAQ on GDPR you can link to for these people questioning it so you don't have to spend much time on it.
This is very much the normal approach. You never need to like it, but depending on your pricing model, it might be a necessary evil. For instance, if you’re selling $40k ARR deals, it prob isn’t too much to ask an early stage company. If you sell $100 ARR deals, you can walk from the customer or tell them no. Also, large vendors like MSFT very much do sign DPAs.
Thanks - this is currently a $5/month customer but I don't know if they intend to scale up. I will ask but there's no way I can agree to them reviewing my subcontractors (which technically includes both employees AND rented services like AWS).
Gotcha - btw - at $5/mo your sweet spot will really be smaller companies that don't have such an overbearing review process. If this is a better fit for larger companies like what you describe, then you really should be charging 10x what you charge now.
Btw - love your website design - good job on that.
Thanks! Appreciate the design feedback. I hear you on pricing. I'd say I'm in the discovery phase of the right market fit. Companies big and small use my service. I'm not sure which is the correct type to optimize for. The ones that require more onboarding help also subscribe to more expensive plans . But it's also nice to have the cheaper customers which require no help at all.