Does the GDPR change this year for the software you use daily? No, the regulation itself is not awaiting an annual update; those rules are fixed. What does change is the practice around it: vendors of accounting software, email programs and CRM systems continually add new features, change subprocessors or adjust their processor agreements. For you as a user, that does not mean you have to start from scratch, but it is worth checking from time to time whether the agreements you once made still match what the tool now does.
This is especially relevant for businesses using multiple cloud tools side by side: an accounting package, an email provider, a scheduling tool, perhaps a CRM. Each provider works at its own pace on its service, and not every change is loudly announced. What matters for you is whether a tool still does what you thought it did when you signed the processor agreement.
The law stands still, the service does not
The GDPR describes what a processor may and must do with personal data you provide, and what should be in a processor agreement. That core does not change suddenly. What does change is the service itself: a tool that only sent emails last year may this year have a function that automatically summarizes emails or suggests drafts. Such a function may use data in a different way than you ever agreed to in the processor agreement. The regulation then does not ask for a new law, but rather a fresh look at an existing agreement.
Features that quietly arrive
The most visible change in recent times is in tools that add artificial intelligence to something you already used: text suggestions in your email program, automatic meeting summaries, a chat function in your CRM. Such features are often automatically switched on during an update, without you explicitly choosing them. Whether and how such a feature processes personal data, and whether that falls within the existing processor agreement, is something you must check for each tool. check for each widely used tool how it handles data provides a first direction for this, with the source of the rule included.
What can shift in a processor agreement
Alongside features, sometimes the agreement itself changes. Vendors work with templates that they update periodically, for example because they bring in a new subprocessor, change their server location, or adjust their security measures. Such changes usually come with a notification by email or a banner in the application, but are far from always read. A processor agreement that was approved two years ago does not automatically remain acceptable now. It is up to you to assess whether the new version still aligns with what you do with that tool, and what that means for the measures linked to your data.
What this concretely means for your business
For most small and medium-sized businesses, this comes down to a recurring, small maintenance moment: once a year go through which tools you use, whether the processor agreement is still current, and whether any features have been added that you did not know about. This is not a legal exercise, more a check you can do together with whoever manages your software. If you are in doubt about the precise interpretation of a provision in an agreement, or whether a new feature fits within the existing arrangements, it makes sense to ask the vendor directly, or consult a lawyer or the Dutch Data Protection Authority.
Where you find this
We maintain a library of well-known SaaS tools and indicate where information comes from in the GDPR text or in a guideline from the EDPB or the Dutch Data Protection Authority, so you can verify it yourself. how those sources are identified explains how that process works. As soon as something changes in a tool you use that affects your situation, that is something that is flagged through a subscription; the knowledge base itself remains free to consult for everyone.
Do you want to know whether this is relevant for your business? Take the free quick-scan or browse through the most frequently asked questions about software and the GDPR to see what your situation requires.