As cloud services are reaching a considerable maturity level, several academics and researchers are exploiting this paradigm to benefit from its advantages. More specifically, with SaaS services' advent, a tremendous number of enterprises rely on their composition as an alternative to their Information Technology infrastructure. While composing SaaS services, achieving the Business Process (BP) goals and objectives through this cloud model is becoming easier and even beneficial; composing multiple SaaS services to support the BP execution is not a trivial practice regarding the complex nature of the BP. Indeed, BP is composed of a set of activities with various functional requirements, data that should be exchanged between each SaaS service, and roles imposing that only authorized actors can perform a specific activity. This paper proposes a comprehensive framework for business process-based SaaS composition that covers the semantic matching between BP activities and SaaS labels and the allocation of BP activities to SaaS services using a genetic algorithm while considering the data and the activities access control issues.