Do I need GDPR compliance?
Short answer
Yes, if any of your users reside in the EU — regardless of where your company is based. GDPR is extraterritorial. Practical minimum compliance: a Privacy Policy, a Data Processing Agreement template for sub-processors, a data-subject rights flow, and breach notification within 72 hours.
GDPR applies if you process personal data of EU residents. Your company's location doesn't matter — the extraterritorial scope is real and enforced.
Minimum compliance for a US startup with EU users (2-4 weeks of work):
- **Privacy Policy** published, specifying legal basis per processing activity, retention, rights.
- **Data Processing Agreement (DPA)** signed with every sub-processor touching EU data (Stripe, Supabase, Vercel, OpenAI).
- **Customer DPA** available for your own B2B customers.
- **Data-subject rights flow** — respond to access / deletion / portability / objection within 30 days.
- **Article 30 register** — internal record of processing activities.
- **Breach notification** — within 72 hours to supervisory authority if high risk.
- **International transfer** — Standard Contractual Clauses + Transfer Impact Assessment for non-EU processors.
Fines are up to €20M or 4% of global annual revenue — whichever is higher. Most enforcement targets either egregious violators or blatant ignoring of data-subject requests. Normal practical compliance is very achievable.
People also ask
Do I need SOC 2 as a startup?
You need SOC 2 the moment your first enterprise prospect asks for it. Most startups don't need it to sell to consumers o…
What is HIPAA compliance for a SaaS?
HIPAA applies if you handle Protected Health Information (PHI) on behalf of a healthcare provider. Core requirements: Bu…