Skip to content
David VanAssche
The Compliance WebUpdated March 20269 min read

Your Entire Software Stack Is Illegal From Day One

Every US SaaS tool in your Dutch subsidiary transfers personal data to the United States -- and each transfer requires a legal mechanism you probably don't have.

Financial exposure: EUR 45K–290.0M

TL;DR
Every US SaaS tool in your Dutch subsidiary transfers personal data to the United States. Each transfer requires Standard Contractual Clauses, a Transfer Impact Assessment, and documentation. Employee monitoring software is largely illegal without works council consent. The Autoriteit Persoonsgegevens fined Uber EUR 290 million for exactly this kind of violation. Proactive compliance costs EUR 45,000. Reactive remediation starts at EUR 95,000 -- if no one files a complaint first.
The American Assumption
You launch your Dutch subsidiary and deploy the same software stack you use everywhere else. Your privacy team updates the cookie banner. Someone adds a GDPR clause to the employee handbook. Done.
The Dutch Reality
Every US SaaS tool transfers personal data to the United States. Under Article 44 of the GDPR, each transfer requires a valid legal mechanism. For a typical subsidiary running 20-40 SaaS tools, that means 20-40 individual data transfer relationships that each need documentation, legal review, and ongoing monitoring. "Our vendor signed a DPA" is not compliance.
The Consequence
Without a GDPR specialist, your Dutch subsidiary operates in continuous non-compliance from day one. A single employee complaint triggers an investigation. The AP can impose fines up to EUR 20 million or 4% of global turnover -- and can order you to cease processing entirely, which means you cannot use your HRIS, run payroll, or operate your CRM.
EUR 290M
Uber fine by Autoriteit Persoonsgegevens
August 2024, for transferring European driver data to the US without adequate safeguards
20-40
SaaS data transfer relationships
Typical number requiring individual legal review for a mid-size US subsidiary
EUR 45,000
Proactive GDPR implementation
Full audit, SCC execution, TIA completion, privacy policies, employee notices, and DPIA

The Obligation Starts on Day One

The obligation starts the moment you have a Dutch employee. Not when you reach a certain headcount. Not when you start processing customer data. The day your first Dutch hire creates a Slack account, you are processing personal data under Dutch jurisdiction. Their name, email address, messages, availability status, and metadata are personal data under Article 4(1) of the GDPR. Slack's servers are in the United States. You are now conducting an international data transfer that requires a legal basis, a transfer mechanism, and documentation.


Employee Data: The Highest-Risk Category

Dutch law imposes restrictions on employee data processing that have no US equivalent:

BSN (burgerservicenummer / citizen service number): Processing is permitted only when specifically authorized by law under Article 46 of the UAVG. The BSN may not be used as an employee identifier in HRIS systems, shared with the US parent for reporting, or stored in US-hosted databases. Using the BSN the way Americans use a Social Security Number -- as a general-purpose identifier -- is a standalone GDPR violation.

Health data: A Dutch manager may know that an employee is sick and the expected return date. They may not know the diagnosis, symptoms, or treatment plan. That information goes only to the bedrijfsarts. Sharing absence-reason data with the US parent's HR system -- which most US HRIS platforms do by default -- violates Article 9 of the GDPR.

Employee monitoring is largely illegal without works council consent

Software that monitors keystrokes, screenshots, mouse movement, application usage, email content, or internet browsing is largely illegal in the Netherlands when applied to employees. Article 27(1)(k) and (l) of the Works Councils Act gives the works council instemmingsrecht (consent rights) over any system that monitors employee behavior or performance. Without works council consent, the monitoring is unlawful regardless of what the US parent's IT security policy requires. Even with consent, proportionality requirements mean most US-style employee monitoring cannot survive a regulatory challenge.


Why You Need a GDPR Specialist

The GDPR requires a specialist who understands both systems. This is not work your US privacy counsel can do remotely. It requires someone who knows what Salesforce's data residency options actually do (and do not do), understands how BambooHR's data flows work at the API level, can read a Dutch works council consent procedure, and can correspond with the Autoriteit Persoonsgegevens when they send an information request.

That specialist is a GDPR consultant -- and at the senior level, a Functionaris Gegevensbescherming (FG), the Dutch term for Data Protection Officer (DPO).

The FG/DPO role is defined in Articles 37-39 of the GDPR. Not every organization is required to appoint one, but the role can be outsourced -- and for most US subsidiaries with 10 to 50 employees, an outsourced FG is the right model.


The Numbers

ItemCost
Initial GDPR assessment (audit, data flow mapping, gap analysis, roadmap)EUR 10,000-20,000
Implementation (SCC execution, TIA, Record of Processing Activities, privacy policies, employee notices, DPIA)EUR 20,000-50,000
Outsourced FG/DPO function (ongoing compliance, annual TIA updates, SAR handling, AP correspondence, training)EUR 12,000-30,000/year
Data Protection Impact Assessment (DPIA)EUR 3,000-8,000 each
Timeline to implement comprehensive program6-12 months

AP Enforcement Actions

CaseFine
Uber (August 2024) -- transferring European driver data to US without safeguardsEUR 290 million
Clearview AI (September 2024) -- plus EUR 5.1M in incremental penaltiesEUR 30.5 million
Dutch Tax Authority (2022) -- unlawful fraud detection data processingEUR 3.7 million

The Cases

Case 1: The Employee Monitoring Disaster. A US logistics company deployed Hubstaff -- screenshots, application tracking, GPS logging -- across its 22-person Dutch subsidiary. No works council consultation. No DPIA. No documented legal basis. An employee discovered the screenshot capture through a system notification glitch and filed a complaint with the AP. The AP found three simultaneous violations: no works council consent (WOR Article 27(1)(k)), no DPIA (GDPR Article 35), no legal basis (GDPR Article 6). The AP ordered cessation of all monitoring within 30 days. Total cost including legal fees, remediation, and the fine: approximately EUR 180,000 -- for a tool that cost EUR 4,000 per year.

Case 2: The HRIS Data Transfer Shutdown. A US technology company ran its global workforce through a US-hosted HRIS. Dutch employee records -- including BSN numbers, salary data, performance reviews, and absence records with reason codes -- were stored on US servers. No SCCs. No TIA. BSN numbers used as primary employee identifiers across systems. When an employee exercised their Article 15 SAR, the response revealed the full scope. The AP ordered suspension of all Dutch employee data transfers to the US until adequate mechanisms were in place. For six weeks, the subsidiary could not process payroll changes, update records, or generate reports. Emergency cost: EUR 95,000 -- work that would have cost EUR 30,000 proactively.

Case 3: The Proactive Compliance Investment. A US medical devices company engaged a GDPR consultant before launching its 18-person subsidiary. The consultant audited 28 SaaS tools, identified 23 that transferred personal data to US servers. Six tools were replaced with EU-hosted alternatives. For the remaining 17: SCCs executed, TIAs completed, supplementary measures documented. An outsourced FG was established at EUR 18,000/year. Total setup cost: EUR 45,000. When the AP sent a routine information request 14 months later, the company responded within the deadline with complete documentation. Inquiry closed with no further action. Estimated savings versus reactive compliance: EUR 200,000+.


What This Means for Your Timeline

GDPR compliance is not a post-launch cleanup task. It is a pre-launch infrastructure requirement, equivalent in urgency to opening a bank account or registering with the KVK.

Your sequencing should be:

  1. Month 1 (pre-launch): Engage a GDPR consultant. Begin the software stack audit and data flow mapping while BV formation is in progress.
  2. Month 2-3: Execute SCCs and complete TIAs for priority tools (HRIS, payroll, email, communication). Draft employee privacy notices. Establish the Record of Processing Activities.
  3. Month 3-4: Complete implementation for remaining tools. Begin works council consent procedure for any IT systems that monitor employee behavior. Establish the FG/DPO function.
  4. Ongoing: Annual TIA reviews, SAR handling, AP correspondence, staff training, and monitoring of regulatory developments.

If you deploy your full US software stack first and address GDPR later, you are building compliance debt at a rate of approximately one new violation per SaaS tool per month.


What This Role Requires

Credentials:

  • CIPP/E certification (Certified Information Privacy Professional / Europe) -- the gold standard credential issued by the IAPP. The privacy equivalent of a CPA for accountants.
  • FG/DPO training -- ICTRecht, Nederlandse Privacy Academie, or Maastricht University DPO certification. No legally certified FG designation exists, but completion of a recognized program confirms the knowledge base.
  • Registration in the FG-register maintained by the AP, if serving as the organization's designated FG.

Essential experience:

  • US-parented companies and US software stacks. Hands-on experience auditing Salesforce, Google Workspace, Microsoft 365, Slack, and US-hosted HRIS/payroll platforms.
  • Employee data processing specifically. Dutch BSN restrictions, health data handling through the bedrijfsarts system, and the legal framework for employee monitoring.
  • Works council consent procedures for IT systems. Where GDPR compliance intersects with Dutch labor law.
  • Autoriteit Persoonsgegevens correspondence. Direct experience with AP enforcement procedures and the escalation pathway.

Practical orientation:

  • Implementation plans, not compliance frameworks. The deliverable is SCC execution packages, populated TIA templates, DPIA documentation, and employee privacy notices -- not theoretical guidance documents.
  • Can work as outsourced FG/DPO. Typically 2-4 days per month, including formal registration with the AP.

Firms and consultancies with established US-subsidiary GDPR practices: Privacy Company, Considerati, ICTRecht, DPO Consultancy, and CRANIUM are among the Dutch privacy consultancies with experience serving international clients. Some larger law firms (Kennedy Van der Laan, Houthoff, Bird & Bird NL) have privacy practices but typically do not offer outsourced FG services.

Red flags:

  • The consultant has never audited a US SaaS stack and proposes to "research each tool"
  • They cannot explain the difference between the DPF and SCCs, or do not mention TIAs
  • They focus exclusively on customer data and treat employee data as an afterthought
  • They have no experience with the Autoriteit Persoonsgegevens
  • They propose a "GDPR compliance framework" as the primary deliverable rather than tool-specific implementation documentation
  • They do not mention works council consent requirements for IT systems
Without an intermediary who understands both American technology culture and Dutch regulatory frameworks, expect 20-30% of consulting hours spent on cross-cultural alignment that could have been resolved in a single briefing.

Have questions about this topic? Let's talk on LinkedIn