Companies can also consult the following resources for further guidance: i. The GNI Principles on Freedom of Expression and Privacy provide direction and guidance to the ICT industry and its stakeholders in protecting and advancing the enjoyment of human rights globally. ii. The Trusted Cloud Principles establish key principles for cloud service providers committed to 1) safeguarding the privacy and security of their customers’ data, and 2) working with governments to ensure the free flow of data, to promote public safety, and to privacy and data security in the cloud. Industry Collaboration Collaborate with companies across the SaaS sector and the broader tech industry to better understand the human rights risks of SaaS products, platforms, and services; to share insights; and to establish overarching guidance and best practices. Consider Creating a Multi-Stakeholder Initiative to Explore SaaS Sector Human Rights Impacts on an Ongoing Basis Engage with SaaS companies, expert stakeholders, and the broader tech industry to discuss common risks and explore the potential for consistent or collaborative approaches. Engage with SaaS companies, expert stakeholders, and the broader tech industry to discuss common risks and explore the potential for consistent or collaborative approaches. This could involve establishing a working group of SaaS companies and civil society organi- zations to focus on human rights due diligence of the SaaS Sector. This may include explo- ration of identified risks, emerging issues, human rights impact assessments of specific categories of products (similar to the HRIA of 5G), or guidance on stakeholder engage- ment, as well as issues beyond human rights, such as ESG issues or responding to investor and shareholder needs. Consider Establishing an Independent Review Committee to Advise the SaaS Sector This committee would act as a review body for companies looking for guidance or feed- back on specific human rights issues, or mechanisms through which they can engage rele- vant stakeholders and rightsholders. Examples of industry review committees include the 43 Human Rights Assessment of the Software-as-a-Service Sector

Human Rights Assessment of the Software-as-a-Service Sector - Page 44 Human Rights Assessment of the Software-as-a-Service Sector Page 43 Page 45