how do I know if the software I use complies with the GDPR

A SaaS tool is GDPR-compliant if the contract and practice are sound

There is no certification or checkmark that officially declares a SaaS tool "GDPR-compliant" — the GDPR does not assess the software itself, but rather the way a vendor handles personal data and what has been agreed upon. In most cases, a tool can be used without significant risk if three things are correct: there is a data processing agreement with the vendor, that agreement covers the required elements such as the purpose of processing and security measures, and it is clear where the data is physically processed and stored.

These last two points are where things often go wrong in practice. Many SaaS tools engage other parties themselves — a hosting provider, a support desk in another country — and this is called a sub-processor. It also happens that data is processed outside the EU, which is subject to additional conditions. Anyone unsure whether a vendor acts as a processor or as a controller in their organization can find more information about the distinction between processor and controller. And anyone who wants to know exactly what must be included in the contract with the vendor can find this on the page about the content of a data processing agreement.

Where this is based on: Articles 28 and 44 GDPR

The obligation to document agreements with a party that processes personal data follows from Article 28 of the GDPR, which also sets out what that agreement must minimally cover — including the engagement of a sub-processor. Processing data outside the EU falls under Article 44 of the GDPR, which imposes additional conditions on transfers to a third country. These provisions apply directly throughout the EU, so the core of the assessment — is there a data processing agreement, and is transfer outside the EU properly covered — does not change from country to country. The EDPB elaborates in its guidelines on how these articles are put into practice, for example when assessing sub-processors and international transfers.