saas compliance checklist
Your SaaS startup has just signed its first annual contracts and a large retailer wants a pilot. Before anyone logs in, its procurement team sends a security questionnaire and asks for a signed data processing agreement. In the same week, your accountant points out that most of the cash from those annual plans cannot count as revenue yet.
A SaaS compliance checklist keeps moments like these from catching you off guard. For a UK startup, it covers company filings, tax and accounting, data protection and the security standards customers expect. Most of those duties arrive as the business grows, so the checklist works best when each one is tied to the stage that triggers it.
Below, you can find which duties each growth stage brings, how annual plans flow through revenue and VAT and which certifications are worth your time.
Key takeaways
- Most SaaS compliance duties start with a growth event, so tie each one to its trigger and give it an owner.
- VAT on an upfront annual invoice is due at once, so set it aside before spending cash that is mostly unearned revenue.
- UK companies selling digital services to EU consumers owe VAT in the customer’s country from the first sale.
- Since 19 June 2026, every data controller needs a process for handling data protection complaints.
What does SaaS compliance cover for a UK startup?
SaaS compliance covers the legal duties your company must meet and the standards customers expect before they trust you with their data. The legal duties come from company law, tax law, data protection law and, if you sell to individuals, consumer law. Companies House, HMRC and the Information Commissioner’s Office (ICO) enforce the first three.
Customers then add commercial standards on top. No law requires a System and Organization Controls (SOC 2) report or a 99.9% uptime promise, yet enterprise procurement teams often make both a condition of signing.
Legal duties and commercial standards also cost you differently when they slip. A missed filing brings a penalty from Companies House or HMRC, while a missing certification costs you a deal. Put the legal duties on your list from day one and add certifications as your growing sales pipeline calls for them.
Your SaaS compliance checklist by growth stage
The easiest way to keep a SaaS compliance checklist current is to tie each duty to the event that triggers it. Founders rarely miss the duties they already know about, but the ones that arrive quietly with a new hire, a new market or a bigger customer slip easily.
The table below shows what each growth stage adds to your list and who usually owns it:
| Growth stage | What becomes due | Usual owner |
|---|---|---|
| Incorporating the company | Director identity verification with Companies House, registering for Corporation Tax within three months of starting to trade and accruals-based bookkeeping | Founders and accountant |
| Collecting your first personal data | The ICO data protection fee unless you are exempt, a privacy notice, processing records and data processing agreements | Founders, often with a lawyer |
| Hiring your first employee | PAYE registration, workplace pension auto-enrolment, right to work checks and IP terms in employment contracts | Founders and payroll provider |
| Taxable turnover passing £90,000 | VAT registration, VAT on UK sales and returns filed through Making Tax Digital software | Accountant |
| First sale to an EU consumer | VAT at the customer’s local rate from the first sale, usually reported through the non-Union OSS scheme | Accountant |
| First enterprise or public sector deal | Security questionnaires, a certification such as Cyber Essentials and negotiated contract and SLA terms | Founders and technical lead |
| Raising investment | Signed IP assignments, up-to-date filings and accounts that hold up in due diligence, plus SEIS or EIS advance assurance if you plan to use the schemes | Founders and accountant |
Duties from earlier stages stay on the list as you move down the table. Your confirmation statement, VAT returns and processing records recur every year, so a shared calendar with a named owner for each date keeps the list from drifting.
How should a SaaS company recognise subscription revenue?
You recognise subscription revenue month by month as you deliver the service, whenever the customer pays. That is the accruals basis, which every limited company must use because the cash basis is only open to unincorporated businesses such as sole traders and partnerships.
Under accruals, cash you collect for months you have not yet delivered sits on your balance sheet as deferred income. It moves into revenue as each month of service passes, so your profit and Corporation Tax follow the work you have actually done.
How you measure that revenue changed for accounting periods starting on or after 1 January 2026. Revised Section 23 of FRS 102 now uses a five-step model drawn from IFRS 15 (FRC Factsheet 10). You identify the contract, list each promise in it, set the price, split that price across the promises and recognise revenue as you deliver each one.
Splitting the price is where SaaS contracts need the most care. An onboarding or implementation fee may need spreading over the contract term if the customer gets no real benefit from it without the software. Service credits you might owe under an SLA can also reduce the price you recognise, so review your standard contracts against the new model before your first year-end under it.
How deferred revenue works on an annual SaaS plan: An example
Emma runs a VAT-registered B2B SaaS company with a 31 March year-end. On 1 January she invoices a UK customer £12,000 plus £2,400 VAT for a 12-month plan that the customer pays the same day.
Her invoice creates the VAT tax point, so the full £2,400 goes on the return covering January. Revenue builds at £1,000 a month, which leaves £3,000 earned and £9,000 deferred when her year-end arrives on 31 March.
The table shows Emma’s position on the invoice date and at her year-end:
| Item | 1 January | 31 March year-end |
|---|---|---|
| Cash received | £14,400 | £14,400 |
| VAT owed to HMRC | £2,400 | £2,400 |
| Revenue recognised | £0 | £3,000 |
| Deferred income | £12,000 | £9,000 |
Had Emma booked the whole £12,000 as income, she would overstate her profit by £9,000 and pay Corporation Tax on money she has not yet earned. She could also end up spending cash she still needs to fund nine months of service.
How does VAT apply to SaaS subscriptions?
SaaS subscriptions are standard-rated at 20% in the UK, but whether you charge UK VAT depends on where your customer belongs and whether it is a business.
Selling SaaS to UK customers
You must register for VAT once your taxable turnover passes £90,000 in any rolling 12 months, or when you expect to pass it in the next 30 days alone. Once registered, you can recover VAT on your own costs, as the guide to reclaiming VAT as a limited company explains.
The timing of the VAT you charge then follows your billing, because HMRC treats a subscription as a continuous supply of services. Each VAT invoice or payment creates its own tax point, whichever comes first (VATTOS9155). Annual billing in advance pulls a full year of VAT into one return, while monthly billing spreads it out. Whichever way you bill, you file returns through Making Tax Digital-compatible software, usually every quarter.
Selling SaaS to EU and other overseas customers
Sales to overseas business customers usually fall outside the scope of UK VAT, because the place of supply is where the customer belongs (VAT Notice 741A, paragraph 6.3). Keep evidence that each customer is in business (a VAT number is the usual proof) and record the sales on your VAT return.
Selling to EU consumers works differently, because the €10,000 EU-wide threshold only helps businesses established in the EU. A UK company owes VAT in the consumer’s country from its very first sale. To keep that manageable, the non-Union OSS scheme lets you register in one EU country and report all of those sales on a single quarterly return.
Corporation Tax, R&D relief and Companies House duties for SaaS companies
Your SaaS company pays Corporation Tax on the profit shown in its accounts, so revenue timing flows straight into your tax bill.
That bill can come down if your engineers resolve genuine technological uncertainty while building the product. Part of that spend may then qualify for R&D tax reliefs, either under the merged scheme or through the enhanced support for loss-making R&D-intensive SMEs.
Alongside HMRC, Companies House sets its own duties, starting with who runs your company. Identity verification for directors and people with significant control became a legal requirement on 18 November 2025. Existing directors give their personal code when the company files its next confirmation statement, while new directors must verify before they are appointed.
Each year you also file a confirmation statement to keep the register up to date. Your accounts reach Companies House by your accounts filing deadline, which for a private company falls nine months after year-end.
Which UK GDPR rules apply to a SaaS business?
UK GDPR and the Data Protection Act 2018 apply to every SaaS business that handles personal data. Which duties fall on you depends on whether you decide how the data is used or process it on a customer’s behalf.
When you are a controller and when you are a processor
You act as a controller for your own staff, website visitors and marketing lists. As a controller, you pay the ICO data protection fee unless an exemption applies, publish a privacy notice and record a lawful basis for each use of personal data. The fee applies to controllers only.
For the data customers upload into your platform, you usually act as their processor. You follow their documented instructions under a data processing agreement, keep processing records and pass the same terms down to sub-processors such as your cloud host. Where your cloud host stores that data outside the UK, each restricted transfer needs a recognised safeguard, such as the International Data Transfer Agreement.
Subject access requests, breaches and the new complaints duty
You have one month to answer a subject access request, extendable by two further months for complex or numerous requests. Where you hold the data as a processor, your job is to help your customer respond within their deadline.
The clock for a personal data breach is far shorter. A controller must report it to the ICO within 72 hours of becoming aware of it, unless it is unlikely to put people’s rights at risk. Processors must tell the affected customer without undue delay, so set out who contacts whom in your incident plan.
Since 19 June 2026, the Data (Use and Access) Act 2025 has also required every controller to give people a way to complain about how their data is handled. Under the ICO’s guidance on data protection complaints, you acknowledge each complaint within 30 days, investigate without undue delay and tell the person the outcome. A line in your privacy notice and a logged route from your support inbox usually cover it.
Security certifications and contract terms enterprise buyers check
Larger customers test your security and your contracts before they sign, usually through a questionnaire and a redline of your terms.
Cyber Essentials, ISO 27001 and SOC 2
Cyber Essentials, the government-backed baseline, is the usual first step for a UK startup. Central government requires it, renewed every year, from suppliers on certain contracts that involve personal data or ICT services (PPN 014).
The table compares what each standard shows and who tends to ask for it:
| Standard | What it shows | Who usually asks for it |
|---|---|---|
| Cyber Essentials | Five basic technical controls, checked each year | UK public sector and smaller UK buyers |
| ISO 27001 | A certified management system for information security | UK and European enterprise procurement |
| SOC 2 Type II | An auditor’s report on how your controls worked over a period | US customers and US-headquartered enterprises |
Start with Cyber Essentials and sound basics such as multi-factor authentication and tested backups. Let your sales pipeline decide whether ISO 27001 or SOC 2 comes next, since each takes months of preparation and an audit every year.
Contracts, IP ownership and consumer subscription rules
Your customer terms should grant a licence to use the hosted service, with clear usage limits and an acceptable use policy. Keep uptime targets and capped service credits within what your engineers can actually deliver.
Your terms only protect the product if the company owns its code, so make sure every founder, employee and contractor has assigned their work to it in writing. A contractor keeps copyright in what they write unless a signed agreement transfers it.
If some of your subscribers are individuals, the regime in the Digital Markets, Competition and Consumers Act 2024 is due to start in January 2027, with the exact date still to be published. You will need clear pre-contract information, renewal reminders and an easy way for customers to cancel.
Getting your SaaS compliance checklist right with Rise Accounting
A SaaS compliance checklist works best as a living calendar with owners and dates, reviewed each time your company reaches a new stage. We help founders keep the finance side of that calendar in order, from revenue recognition and VAT on annual plans to Companies House filings and accounts that stand up to investor scrutiny.
We work with SaaS and tech start-ups from their first customer onwards, so we know where the gaps tend to open up as a product finds its market. If you would like a second pair of eyes on where your company stands today, our team is happy to talk it through.
Frequently asked questions
How long do I have to register for VAT after crossing the threshold?
You must register within 30 days of the end of the month in which your rolling turnover went over £90,000. Your registration then takes effect from the first day of the second month after that month.
Do I need a separate data processing agreement with every customer?
Not a separate one, but you do need written processing terms with every customer whose personal data you handle. Most SaaS companies use one standard data processing agreement that sits alongside their main terms.
Do I need Cyber Essentials Plus or is the basic certificate enough?
The basic certificate is usually enough to start with, since it is a verified self-assessment that answers most buyers’ first security questions. You only need Cyber Essentials Plus, which adds an independent technical audit, when a public sector or higher-risk contract asks for it.
Does the new subscription regime apply to my business customers?
No, the subscription rules only cover contracts between a trader and a consumer. If you sell to individuals as well as businesses, your consumer billing will need the new reminders and cancellation route.
Will my company’s profit and loss become public under the Companies House changes?
Not if you opt out, because small companies and micro-entities can keep it off the public register. From 1 April 2028 you must still file it with Companies House, where HMRC and law enforcement can also see it.
Matt co-founded Rise Accounting and leads the firm’s corporate finance and FinOps strategy practice. He works closely with startups and scale-ups navigating funding rounds, financial planning and investor readiness. Before Rise, Matt built deep expertise across financial modelling, cash flow management and growth-stage advisory.
