GDPR (General Data Protection Regulation)

What is GDPR?

The General Data Protection Regulation is European Union law that took effect in May 2018. It governs how organizations handle personal data, meaning any information that can identify a living person: names, emails, IP addresses, device identifiers, and account records all count.

The part founders miss is reach. GDPR applies based on whose data you process, not where your company sits. If you are a two person startup in Denver with paying users in Berlin, you are in scope. The United Kingdom kept an equivalent regime after leaving the EU, so a similar standard applies there.

The regulation rests on principles rather than a checklist of technologies. You need a lawful basis for processing personal data (for startups, usually consent, legitimate interests, or performing a contract). You should collect only what you need, keep it only as long as you need it, secure it, and be transparent. People have rights over their data, including access, correction, deletion, and portability, and you generally have one month to answer such a request. This page is a plain-English overview, not legal advice.

What GDPR asks you to actually do

In operational terms, most early stage companies need a short list of things in place. A privacy policy that says what you collect, why, and who you share it with. A record of what personal data you hold and where it lives, including inside third party tools. Data processing agreements with vendors that touch user data on your behalf. A working way to delete or export a user's data on request. And a breach plan: serious breaches must be reported to the relevant supervisory authority within 72 hours of becoming aware.

Consent has specific requirements when you rely on it. It must be freely given, specific, informed, and as easy to withdraw as to give. Pre-ticked boxes do not count, and burying agreement inside terms of service does not either.

Why GDPR matters for startups

Enforcement is the obvious reason: penalties can reach 20 million euros or 4 percent of global annual turnover, whichever is higher, though the largest fines have landed on very large platforms rather than small teams.

The practical reason is sales. The moment you sell to European businesses, procurement asks for your data processing agreement, subprocessor list, and retention policy. A startup that cannot answer stalls in review for weeks. Getting the basics right early is cheaper than retrofitting them mid deal, and it forces you to learn what data you actually collect.

GDPR in practice

Imagine you run a small analytics tool and land your first EU customer, a mid sized retailer. Their security review asks three questions: where is data stored, who are your subprocessors, and can you delete a user's records on request. You have never written any of this down.

You spend a week mapping it and find you are piping raw events with email addresses into two tools you no longer use, while your support inbox holds customer records going back a year. You cut the unused integrations, add a retention rule, write a one page subprocessor list, and build a delete endpoint. The deal closes, and the next enterprise review takes a day instead of a week.

Common mistakes

• Assuming it does not apply to you. Company size does not exempt you. Having EU users is what puts you in scope.
• Cookie banners as compliance theater. A banner that drops tracking cookies before you click anything provides no valid consent. Fix the loading behavior, not just the wording.
• Bought lists for outreach. Cold email marketing to EU individuals without a valid basis is one of the easiest ways to draw a complaint.
• Forgetting the tools. Your CRM, session recorders, and support desk all hold personal data. Vendors are part of your compliance surface.
• Collecting data "just in case." Every extra field is a liability with no offsetting benefit. Data minimization is the cheapest control you have.

How to get started

Start with an inventory: list every place personal data enters, sits, and leaves your product, including SaaS vendors. Delete what you do not need. Then write the policy, sign the agreements, and build the deletion path. The official GDPR resource site is a reasonable free starting point, and a lawyer review is worth it once you are selling in Europe.

Handled well, privacy work overlaps with good practice elsewhere: cleaner customer segmentation, fewer stale integrations, and analytics you can actually explain to a customer who asks.