GDPR (General Data Protection Regulation) is the EU’s landmark privacy law — and it applies to any company that processes personal data of people in the EU, regardless of where the company is based. If your startup has even a handful of European users, GDPR applies to you.
This guide breaks down what GDPR actually requires and how to comply without a legal team on retainer.
What Counts as Personal Data?
Under GDPR, personal data is any information that can identify a person, directly or indirectly. This includes:
- Name, email, phone number
- IP addresses and cookie identifiers
- Location data
- Employment and financial information
- Any unique user ID that can be linked back to a person
If your app stores any of the above for EU residents, you’re processing personal data under GDPR.
Key GDPR Principles
GDPR is built on seven core principles. Every decision you make about data should align with these:
- Lawfulness, fairness, and transparency — Have a legal basis for processing; be upfront about what you do with data
- Purpose limitation — Collect data only for specific, stated purposes
- Data minimization — Don’t collect more than you need
- Accuracy — Keep personal data up to date
- Storage limitation — Don’t keep data longer than necessary
- Integrity and confidentiality — Protect data with appropriate security measures
- Accountability — Be able to demonstrate compliance
GDPR Compliance Checklist for Startups
1. Map your data flows
Document what personal data you collect, where it’s stored, who has access, and what third parties receive it. This is the foundation of GDPR compliance.
2. Establish a legal basis for processing
For each type of data processing, identify your legal basis. The most common for startups:
- Consent — User explicitly agrees (must be freely given, specific, informed)
- Contract — Processing is necessary to deliver your service
- Legitimate interest — You have a justifiable reason (with a balancing test)
3. Update your privacy policy
Your privacy policy must clearly explain: what data you collect, why, how long you keep it, who you share it with, and how users can exercise their rights. Write it in plain language, not legalese.
4. Implement cookie consent
Non-essential cookies (analytics, marketing) require opt-in consent before being set. A compliant cookie banner must let users accept, reject, or customize their choices.
5. Handle data subject rights
Under GDPR, individuals have the right to:
- Access their data
- Rectify inaccurate data
- Erase their data (“right to be forgotten”)
- Port their data to another service
- Object to certain types of processing
- Restrict processing in certain situations
Build processes (or features) to handle these requests within 30 days.
6. Secure personal data
Implement appropriate technical and organizational measures: encryption, access controls, regular security testing, and staff training.
7. Set up a breach notification process
If a data breach occurs, you must notify your supervisory authority within 72 hours and affected individuals without undue delay if the breach poses a high risk to their rights.
8. Review third-party processors
Any vendor that processes personal data on your behalf needs a Data Processing Agreement (DPA). Review their security practices and ensure they’re GDPR-compliant.
9. Appoint a DPO (if required)
A Data Protection Officer is required if your core activities involve large-scale processing of sensitive data or systematic monitoring of individuals. Most early-stage startups don’t need one, but it’s good practice to designate someone responsible for privacy.
GDPR Fines: What’s at Stake?
Penalties can reach up to €20 million or 4% of global annual revenue, whichever is higher. But enforcement isn’t just about fines — reputational damage and lost customer trust are often more costly for startups.
Frequently Asked Questions
Does GDPR apply to U.S. startups?
Yes, if you have users in the EU or offer goods/services to people in the EU. GDPR is based on where the data subject is located, not where the company is incorporated.
What’s the difference between a data controller and a data processor?
A controller decides what data to collect and why. A processor handles data on behalf of the controller. If you run a SaaS product, you’re likely both a controller (for your own users) and a processor (for your customers’ data).
How does GDPR relate to SOC 2?
They’re complementary. SOC 2 focuses on security controls and operational processes. GDPR focuses on privacy rights and lawful data processing. Many controls — encryption, access management, incident response — overlap. Using a tool like Complara lets you track both frameworks in one place.