What Is SaaS (Software as a Service)?

In September 2011, the US National Institute of Standards and Technology (NIST) described three service models of cloud computing in Special Publication 800-145. They differ in what the customer controls.

With Software as a Service, the consumer uses the provider's applications running on a cloud infrastructure, through a browser or a program interface. The consumer does not manage or control the network, servers, operating systems or storage, or even individual application capabilities, apart from limited user-specific configuration settings.

With Platform as a Service, the consumer deploys their own or acquired applications onto the cloud infrastructure. They control those applications and possibly settings of the environment they run in, but not the infrastructure underneath.

With Infrastructure as a Service, the consumer provisions processing, storage, networks and other fundamental computing resources and can run any software on them, including operating systems. They control operating systems, storage and deployed applications, and possibly, to a limited extent, select networking components such as host firewalls, not the infrastructure underneath. More on this in the web hosting entry.

The EU Data Act, Regulation (EU) 2023/2854, names the same three models in recital 81 as forms of data processing services. Its rules on switching provider therefore apply, in principle, to SaaS too.

The provider serves many customers with the same resources. NIST calls this resource pooling: the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model and are assigned according to demand. The customer generally does not know exactly where their data is held, but may be able to specify the location at a higher level, such as country or data centre.

Usage is measured and, according to NIST, typically billed on that basis. NIST gives storage, processing, bandwidth and active user accounts as examples of what is measured. In practice, customers often pay per user per month or per plan.

In marketing, many tools come as SaaS: the CRM, often the CMS, web analytics, and tools for email and marketing automation. According to Eurostat, 52.7% of EU enterprises with ten or more employees (excluding finance, agriculture, forestry, fishing and mining) used paid cloud computing services in 2025, and 14.7% used CRM software as a paid cloud service.

SaaS saves installation, servers and updates. In exchange, the data sits with the provider, and that has two consequences.

The first concerns data protection. If the provider processes personal data on the company's behalf, it is a processor under the GDPR. Article 28(3) requires a contract or other legal act that binds it. Among other things, that contract must state that, at the end of the service, it deletes or returns all personal data, at the choice of the controller, unless the law requires the data to be stored.

The second concerns switching. The Data Act has applied since 12 September 2025. Under Article 25, the contract must set a maximum notice period of two months for initiating the switch and a transitional period of at most 30 calendar days, during which the provider supports the switch or the transfer of all exportable data. If that is technically unfeasible, the provider must notify the customer, with justification, within 14 working days of the switching request and may set a different period of up to seven months. Under Article 29, providers may only charge reduced switching charges until 12 January 2027, and none for the switch itself after that. Article 31 exempts custom-built services and trial versions; where several services are used in parallel, Article 34 still allows cost-based data egress charges. The Commission has proposed amendments to the Data Act (COM(2025) 837); according to EUR-Lex, they were not in force on 23 October 2026.

• Before signing, clarify which data can be exported and in which format.
• Review the data processing agreement before any personal data enters the tool.
• Record the country or data centre where the data is stored.
• Export regularly and check that the export opens in another system.
• Disable accounts of people leaving the company straight away, since access is possible over the internet.
• Keep notice periods, contract terms and plans of all SaaS tools in one place.

• Assuming the data will still be available after cancelling, without knowing the deadline.
• Letting personal data be processed without a data processing agreement in place.
• Keeping backups only in a format no other tool can read.
• Subscribing to several tools for the same task because nobody has an overview.
• Confusing SaaS with hosting: with hosting, you run your own software on someone else's infrastructure.