GDPR problems that surface after the deal closes

GDPR due diligence on a SaaS target has a specific failure mode: the paperwork passes while the infrastructure fails. The privacy policy is polished, the record of processing exists as a document, a DPA is downloadable from the website. Then you trace where personal data actually flows and discover that the paperwork describes a company that does not exist. These gaps rarely block a deal, and that is exactly the problem. They surface after closing, when the buyer owns them.

Four gaps account for most of what we find in European deals.

The data map that does not exist

Article 30 requires a record of processing activities, and most targets have one: a template, filled in optimistically, some time ago. Far fewer can answer the operational version of the question: for this one named customer, list every system that holds their personal data. The production database, yes. Also the analytics stack, the error tracker capturing full request payloads, the log pipeline, the data warehouse, the support desk, the marketing tools, and the spreadsheet from that one migration in 2024 that still lives in someone’s drive.

If nobody can enumerate the copies, every downstream obligation is guesswork: access requests, deletion, breach scoping. So we test with exactly that exercise, one real customer traced end to end. It takes a morning, and it tells you whether the compliance program is connected to the engineering reality.

Processor agreements that point both ways

Downstream, the subprocessor list is usually stale. It omits the LLM API added for the new AI feature, the transcription vendor, the tool someone adopted last spring. Vendors processing personal data with no DPA in place, or under clickthrough terms nobody read, are inherited liabilities.

Upstream is worse, because it is contractual. The target’s own DPA promises customers things the systems cannot do: deletion within 30 days, EU-only processing, breach notification within 48 hours. Every such promise is a liability multiplied by the number of signed customers, and enterprise customers audit these promises at renewal.

Residency claims the infrastructure contradicts

"Hosted in the EU" tends to mean the primary database sits in Frankfurt. Meanwhile logs stream to a US observability vendor, backups replicate to a US region, support staff query production from wherever they happen to be, and the AI features send customer text to model endpoints outside the promised boundary. The claim was true when the architecture diagram was drawn, then drifted, one pragmatic decision at a time. AI features are currently where we find the most drift, and keeping them inside a residency promise is a design discipline most teams have not yet built.

Severity depends on the sales motion. If enterprise contracts were won on residency commitments, the gap is not a compliance footnote; it touches the revenue those contracts represent.

Deletion that does not delete

Offboarded customers whose data persists in backups, in the warehouse, in search indexes, in embeddings. A retention policy exists as a PDF; no code implements it. The test is cheap: pick a customer who churned a year ago and search for them. Where customer data has fed model training, deletion becomes genuinely hard rather than merely neglected, which connects this gap to training data rights, a diligence question with litigation of its own.

What GDPR remediation costs after close

The headline fear is the fine ceiling, up to 4 percent of global turnover, but in our experience the base case cost is not the regulator. The base case is quieter and still expensive: engineering quarters to build the data map, the deletion machinery and a residency architecture that matches the contracts; renegotiation or churn when enterprise customers audit; pipeline deals stalling on security questionnaires that now have to be answered honestly.

In diligence we size that remediation in engineering months and put it in the risk register with a severity, next to what the security review finds, because the two share causes and often share fixes. A buyer can negotiate anything it can quantify; what it cannot do is un-inherit a gap after closing. If GDPR exposure is plausible in your deal, it deserves a focused pass inside a broader technical due diligence while the price is still open.