In short
Choose a SaaS tool in five steps: write down requirements, check data protection including the data processing agreement and data location, settle the exit and data export in advance, calculate costs over three years and use the trial for real workflows. Decide on criteria you weighted beforehand, not on the impression a demo leaves.
Requirements first: write down must-haves and nice-to-haves before you compare products.
Check data protection: data processing agreement, data location, sub-processors and international transfers.
Plan the exit up front: check export formats and deletion before you sign. Since September 2025, the EU Data Act strengthens switching rights.
Calculate three-year costs: factor in plan upgrades for SSO or EU data residency.
Structure the trial: real workflows with test data, named testers, a fixed end date.
Signing up for a SaaS subscription takes five minutes. Living with it can take years: your data sits with the vendor, the team adapts its workflows, and costs grow with every new licence. This checklist breaks the selection into five steps. It is written for small businesses in the EU without a dedicated IT department.
What belongs on the requirements list?
Start with tasks, not products. Write down which workflows the tool must support and who will use it. One page is enough. Include these points:
Must-haves: features without which the tool is out.
Nice-to-haves: useful, but not essential.
Number of users: today and in two years.
Integrations: email, calendar, accounting or CRM.
Basics: interface language, support hours, mobile apps.
Keep must-haves and nice-to-haves strictly apart. A tool that misses a must-have is out (which saves long debates). Our comparisons help for specific categories, for example CRM systems or project management tools. Accounting software in Germany also has to meet legal duties such as e-invoicing.
How do you check data protection?
If a SaaS vendor processes personal data on your behalf, it is usually a processor under the GDPR. The German data protection conference (DSK) lists cloud computing as a typical case in its short paper no. 13. You then need a contract under Article 28 GDPR. Check these points before you buy:
Data processing agreement (DPA): does the vendor provide one, for example as a download or in the admin console? Our guide to the DPA for SaaS explains what it must contain.
Data location: where are the data and the backups stored? Some vendors offer EU data residency only on higher plans.
Sub-processors: is there a public list, and does the vendor notify you of changes?
International transfers: if data flows to the US, you need a basis such as the EU-US Data Privacy Framework or standard contractual clauses.
Evidence: ISO/IEC 27001, a SOC 2 report or a C5 attestation show that third parties audited the security controls.
The C5 catalogue of the German Federal Office for Information Security (BSI) sets minimum requirements for secure cloud computing. Auditors check the criteria and issue an attestation. The BSI itself does not take part in the audit.
How do you get out again?
Settle the exit before you sign. Ask which formats you can export your data in. Check whether attachments, comments and history are included. Common formats are CSV for tables and JSON or XML for structured content.
The EU Data Act has applied since 12 September 2025. Among other things, it governs switching between cloud services and explicitly covers SaaS. According to an overview by the law firm Eubelius, the notice period for starting a switch may not exceed two months. From 12 January 2027, providers may no longer charge for switching.
Is the export documented, and can you trigger it yourself?
Does the vendor confirm deletion after the contract ends?
What are the term and the notice period?
Can you run old and new tools in parallel during the move?
What does the tool really cost?
The price per user per month is only part of the bill. Calculate costs over three years. That period shows how plan tiers and growth interact.
Cost type | What to look for |
|---|---|
Licences | Billing per user, per active user or flat rate, discount for annual payment |
Plan upgrades | SSO, admin controls or EU data residency often only on higher tiers |
Roll-out | Data migration, setup, training |
Integrations | Connectors or automation services with their own subscription |
Exit | Export, parallel operation, notice periods |
An example from team chat: Slack offers data residency in regions such as Frankfurt only from the Business+ plan. According to the pricing page, SAML single sign-on also starts at that plan. Upgrades like these change the calculation noticeably. See our team chat comparison for details.
How do you make the most of the trial?
Run the trial like a small project. Without tasks and an end date, a trial usually ends with a gut feeling. Proceed as follows:
Name two or three people who will use the tool every day.
Run three real workflows with test data instead of customer data.
Contact support once with a specific question and rate the answer.
Trigger a full data export and open the result.
Record all results in the same scoring matrix.
Do not use real personal data during the trial until a DPA is in place. Free plans are good for testing usability. They often do not show all features of the plan you will actually buy.
How do you make the decision?
Weight your criteria before you watch any demos. Weighting afterwards often just justifies the favourite. Our criteria and weights are published on the page How we evaluate software. Feel free to use them as a template.
Write the decision down briefly: criteria, scores, open risks. This helps when you have to demonstrate compliance and at the next renewal. Your next step: write the requirements list before you book the first demo.
Frequently asked questions
How many tools should I compare?
For small businesses, two to four candidates on the shortlist are usually enough. More tools lengthen the trial without improving the decision.
Do I need a DPA for every SaaS tool?
You need a data processing agreement whenever the vendor processes personal data on your behalf. That applies to almost every business tool, such as chat, CRM or accounting.
What does the EU Data Act say about switching?
The Data Act has applied since 12 September 2025 and requires cloud and SaaS providers to support switching. From 12 January 2027, they may no longer charge for it.
Is a free plan enough for testing?
For usability, yes. Features such as SSO, admin controls or EU data residency are often missing from free plans. Check them in a trial of the plan you intend to buy.
Sources
- Kurzpapier Nr. 13: Auftragsverarbeitung, Art. 28 DS-GVO , Datenschutzkonferenz (DSK) , 2018-12-17
- Cloud Computing Compliance Criteria Catalogue (C5) , German Federal Office for Information Security (BSI)
- Data Act , European Commission
- The EU Data Act in force: What changes on 12 September 2025? , Eubelius , 2025
- Data residency for Slack , Slack
- Slack pricing , Slack
