GDPR for web applications: lawful basis, cookies, and processor chains

A record of processing (ROPA) that lists purposes, recipients, and retention is the spine. Cookie banners that fire analytics before consent are still a leading complaint theme in 2026, but they are a symptom. The disease is unmapped processing.

Processor agreements and a living subprocessor list matter more than a one-time legal memo. Support tools, error trackers, and “free” product-analytics SDKs are processors (or independent controllers — which is worse if you never noticed).

Legitimate interest for strictly necessary security logs is a different argument from legitimate interest for advertising. Do not let marketing borrow the security basis.

Web apps also fail GDPR in the account model: shared logins, no verified identity for access requests, and customer-content that the processor cannot find because it lives in a third search index. Rights are a data-architecture problem wearing a legal costume.

Controller versus processor is a role per processing activity, not a personality trait of the company. A B2B SaaS is often processor for customer content and controller for its own billing, website, and hiring. Mixing those in one DPA template creates lies in both directions.

Transfers are not “we use AWS.” They are a mechanism (adequacy, SCCs, derogation) plus a Transfer Impact Assessment where Schrems-style scrutiny still applies. US-hosted tools remain a paperwork and architecture problem even after partial adequacy frameworks; read the actual tool, not the headline.

Rights need a workflow: identity verification, a one-month clock, and a path into backups and vendors. That is engineering and ops. The checklist will remind you it exists; it will not design the ticket queue.

Pre-ticked analytics, reject buttons that take three more clicks than accept, and policies that list tools you removed two years ago are still how complaints start. ePrivacy sits beside GDPR here — see the cookie field note.

No operational process to fulfill deletion or export within one month is more serious than a typo in the privacy policy. If engineering never built the job, legal cannot “handle it in Zendesk.”

Treating every US vendor as “in-EEA processing” because the company has a Dublin entity is a common fiction. Follow the data, the admin access, and the support laptops.

A second failure is launching a new tracking SDK from marketing without a ticket. GDPR programs die in the tag manager, not in the policy. If product can ship a processor without legal and security seeing it, the ROPA is already stale.

Walk product, engineering, and legal through the same phases before you brief counsel on residual risk. The checklist is the shared agenda; the ROPA is the output.

When an item mentions DPIA, cookies, or transfers, jump to those companion notes. This page is the web-app overview, not the deep dive on Article 35 or SCCs.

Tick an item only when the artifact exists in the live product: the ROPA row, the DPA, the banner record, the deletion job. A workshop slide is not evidence. The checklist is a shared agenda so engineering and legal argue once, in order, instead of in parallel Slack threads.