Software deals into Europe rarely die on price or product. They die in the third week, after the demo has gone well and the champion is enthusiastic, when the buyer's privacy counsel sends four questions the vendor has never had to answer in writing. The questions are always roughly the same. Where does the data sit. Who can access it and from which country. Who are your subprocessors and how will we be told when they change. And what happens if a European regulator asks our company to justify using you. Most vendors outside Europe answer the first well, the second vaguely, the third incompletely, and the fourth not at all. That fourth answer is the one that matters.
Your buyer is not asking whether your product is secure. They are asking whether they can explain you to their regulator
This is the shift that regional and non-European vendors consistently miss. Under European data protection law your customer remains accountable for what you do with the personal data they entrust to you. You are not a supplier being assessed on merit; you are a link in somebody else's compliance chain, and the person reviewing you is personally answerable for the decision to add you to it. Everything that follows is downstream of that. A reviewer who cannot construct a defensible paragraph explaining your role will block the purchase, and will do so without ever telling your sales team that is what happened.
The seven artefacts that unblock deals
A data processing agreement you can actually sign. Written from your side, reflecting what your product does, with the current standard contractual clauses attached as a module for transfers. If every deal starts with your buyer's template and three weeks of redlines, you have chosen the slowest possible path. A published subprocessor list, with change notification. Every third party that touches customer data, named, with location and purpose, plus a mechanism for telling customers before you add one. A transfer assessment of your own flows. Most vendors expect the buyer to write this. The vendors who close faster write it themselves, covering where data goes, what legal regime applies there, what safeguards exist, and what government access looks like in practice. Security documentation. A recognised certification if you have one; if not, a completed standard questionnaire, a recent penetration test summary and an honest description of your controls. Absence of a certificate is survivable. Absence of documentation is not. A data inventory for your product. Which categories of personal data the product holds, in which components, for how long, by default and by configuration. Deletion and export that work, with evidence. Including backups, with a stated timeline, and a support process that can execute both without engineering heroics. Breach notification commitments with a realistic clock. Your customer has statutory deadlines. If your contract promises notification without undue delay and your monitoring would take a week to notice, you have written a term you cannot honour.
| Artefact | Question it should answer |
|---|---|
| Processing agreement | What processing and transfer commitments can the vendor actually meet? |
| Subprocessor list | Who receives data, where, for what purpose and with what change notice? |
| Transfer assessment | Which cross-border flows and safeguards must be explained? |
| Security documentation | What control evidence can be provided honestly? |
| Product data inventory | What categories are held, in which components and for how long? |
| Deletion and export evidence | Can operations execute the promised timelines, including copies? |
| Breach commitments | Can detection and notification meet the agreed clock? |
Qualitative summary of this article's source text, not a measured outcome or performance estimate.
Four product decisions that determine every answer
Paperwork cannot rescue a product built without these in mind. Hosting region as a customer-level choice. Whether a European customer can be provisioned in Europe without a fork of your codebase, and whether that includes the secondary systems — search indexes, queues, caches, analytics stores, backups — rather than just the primary database. The backup and the search index are where this claim usually breaks. Support access, scoped and logged. Who on your team can see customer data, from where, under what approval, for how long, and with what record. Standing production access for an entire support organisation is the single most common finding in a serious review. Your own third-party stack. Error tracking, product analytics, session recording, the support chat widget, the email service, the AI feature you added last quarter. These are your subprocessors. Vendors routinely publish a list naming their cloud provider and omit five services that receive more personal data than the cloud provider does. Tenancy, described concretely. Shared, isolated, or dedicated — and what precisely is isolated. Buyers have learned to ask what "logically separated" means in your architecture, and a vague answer reads as a security finding.
Sequence it by stage, not by anxiety
Before your first European customer: the processing agreement, the subprocessor list, the honest questionnaire. Days of work, not quarters. After roughly five: the European hosting option, your own transfer assessment, and demonstrable deletion. Before enterprise or regulated buyers: certification, a penetration test cadence, subprocessor change notice with objection rights, and a named person who owns this and answers questions within two days rather than two weeks. The expensive mistake is retrofitting hosting regions and support access controls after the architecture has hardened, at which point the fix consumes a quarter of engineering capacity and was priced into the deal at zero.
Practical Guidance for EU Market Readiness Review
- Write your own processing agreement instead of negotiating from the buyer's.
- Publish the complete subprocessor list, including analytics, support and error tracking.
- Produce your own transfer assessment rather than waiting for a customer to demand one.
- Time-box and log support access to production data, with approval on record.
- Prove deletion end to end, including backups, with a documented timeline.
- Make hosting region a provisioning choice, covering secondary systems too.
- Name one owner for security and privacy questions, with a two-day response standard.
- Track why deals stall in review, because nobody will volunteer that answer.
The Regional Angle
Three realities shape this for vendors selling out of this region. The first is that regional credibility does not travel. Gulf software companies win at home on relationship, reference and the reputation of their logo wall — a ministry, a large bank, a well-known family group. In a European review, none of that is evidence. The reviewer wants a certificate, a completed questionnaire, a test report and a signed agreement, and will not substitute reputation for documentation no matter how impressive the customer list. The uncomfortable translation is that a regional vendor's strongest domestic asset is worth almost nothing in the market it is trying to enter, and the asset that matters there — a boring, complete document pack — has no value at home. Budget for it as market entry cost, not as compliance overhead. The second is that the region's structural commercial advantage is also its most visible finding. Many vendors here compete on round-the-clock human support delivered by teams in the Gulf, South Asia or North Africa, with broad access to production so that problems get fixed on the first call. In a European transfer assessment, that advantage appears as a named transfer of personal data to a third country, performed by identified individuals, and the reviewer will ask about it specifically. Do not dismantle the support model; document it and constrain it. Role-based access rather than blanket access, requests raised and approved rather than standing permissions, sessions logged and time-limited, and a written statement of which team sits where and what they can see. Presented that way it reads as maturity. Presented as "our engineers can access anything, quickly" it ends the process. The third is that this work has a second buyer. Regional software companies raising institutional capital or preparing for acquisition discover that technical and legal diligence asks for very nearly the same pack: the processing agreements, the subprocessor register, the security documentation, the data inventory, the deletion evidence, the breach history. Vendors who built it for European sales find the diligence data room ninety per cent assembled; vendors who did not spend the eight weeks before a term sheet building it under time pressure, which is when it gets done badly and noticed. If the European revenue case alone will not fund this work, the funding case usually will.
The objection worth taking seriously
The strongest objection is that this is compliance gold-plating pushed by people who bill for it. European buyers sign when they genuinely want the product. Small vendors win on capability and get waived through review with a signed agreement and a bit of goodwill. Certification costs real money and takes months, and building an elaborate trust apparatus before you have meaningful European revenue is a textbook distraction from the only thing that matters early, which is whether anyone wants the software. At the small end that is simply correct, and any adviser who tells a pre-revenue company to pursue certification before product-market fit is giving bad advice. But the objection quietly assumes you find out when you fail, and you do not. Security and privacy reviews decline silently; the champion goes quiet, the deal slips a quarter, and the loss gets logged as budget or timing. The buyers with review processes are also the ones with procurement budgets and long retention, so the filter removes exactly the customers you most want. Three of the seven artefacts cost days. And the four product decisions — hosting region, support access, your own third-party stack, tenancy — are nearly free to make correctly in year one and brutally expensive to reverse in year four, which is the only real argument for doing any of it early.
Common Questions
Do we need a European entity to sell there?
Not generally for data protection purposes, though some buyers' procurement systems make contracting easier if you have one. The obligations attach to what you do with the data, not to where you are incorporated.
Is certification mandatory?
No, but its absence shifts the burden to documentation you must produce anyway. Below enterprise, a complete questionnaire and a recent test report usually suffice.
Can we just sign whatever the customer sends?
You can, and you will eventually sign commitments your operations cannot meet — typically on breach timing, deletion windows and audit rights. Signing your own paper is faster and safer.
What should we expect over the next twelve months?
Expect the emerging transatlantic arrangement, if it is adopted next year, to reduce transfer friction for American vendors specifically — which changes the competitive position of everyone else, because a European buyer comparing you against a United States competitor will suddenly face less paperwork on their side of the table. Expect a new questionnaire section on artificial intelligence within months, asking whether customer data trains models, where inference runs and whether outputs are retained; the vendors with a clear answer will be a small minority. Expect subprocessor change notification with objection rights to become a negotiated clause rather than a courtesy. And expect certification to slide down-market from enterprise into ordinary mid-market procurement, which will make the next two years more expensive for vendors who defer it again.
EU Market Readiness Review — we assemble the pack European buyers actually ask for, fix the product decisions that are cheap now and painful later, and tell you which deals are stalling in review rather than in sales.