The AEPD's 2025 Data Protection Awards published in April reward organizations that demonstrate exceptional privacy practice. Reading the case studies is the cheapest way to understand what Spain's regulator considers best-in-class. Four patterns emerge that any SaaS can adopt.
Pattern 1: privacy-by-default at sign-up
Winning organizations consistently default new accounts to the strictest privacy settings, requiring active opt-in to lower protection. This is true even when not strictly required by Article 25 GDPR.
Pattern 2: public versioning of policies
Winners publish version history with side-by-side diffs of changes. Users and auditors can compare any two versions. This transparency layer transforms an annual policy update from a compliance burden to a trust event.
Pattern 3: proactive transparency reports
Several winners publish quarterly or annual transparency reports detailing data requests received, breach notifications, and DSAR statistics. Voluntarily. The reports become content marketing for privacy-conscious customers.
Pattern 4: dedicated privacy contact channel (not just email)
Winners offer phone, video call or in-app chat for privacy questions, not just a privacy@example.com inbox. The channel matches the seriousness of the question.
| Pattern | Cost to adopt | Trust signal |
|---|---|---|
| Privacy-by-default | Engineering: 1-2 sprints | Strong |
| Public versioning | One-time setup | Very strong |
| Transparency reports | 1 day per quarter | Strong |
| Multi-channel contact | Operational design | Medium-strong |
None of the winning organizations were giant corporations. Mid-sized SaaS and public-sector bodies dominate the list. The patterns are accessible to any SaaS willing to commit; they are not the result of unlimited compliance budgets.
Conclusion
The AEPD awards are a public benchmark. Reading the case studies once a year is a low-cost source of best practice that does not require attending conferences or hiring consultants. Adopting one pattern per year separates SaaS that take privacy seriously from SaaS that talk about it.
To publish your privacy policy with version history visible by default, try Termerly free.