GDPR for startups: what you actually need to do, and when

Does GDPR apply to a small startup, even one outside the EU?

Yes on both counts. The GDPR (Regulation (EU) 2016/679) has no size threshold: it covers processing in the context of an establishment in the EU (Article 3(1)). It also reaches companies with no EU establishment when they offer goods or services to people in the EU, paid or free, or monitor their behaviour there (Article 3(2)).

That second rule catches plenty of US and UK startups with European users. Where it applies, Article 27 generally requires a written appointment of a representative in the EU, unless the processing is occasional, does not involve sensitive data on a large scale and is unlikely to create a risk to people.

Fines make the headlines. For a startup, the first real test can come earlier and from elsewhere: an enterprise customer's security questionnaire, or an investor's due diligence list.

What does minimum viable GDPR compliance look like?

It looks like eight habits, set up roughly in this order. This is our own working checklist for early-stage products; bring in a privacy lawyer as the data and the customer base grow.

Do you need records of processing and a DPO?

Records, almost certainly. Article 30(5) exempts organisations with fewer than 250 employees only when their processing is occasional, unlikely to create a risk and free of special-category or criminal data. A product that handles user accounts every day is not processing occasionally.

In May 2025 the European Commission proposed widening the exemption to organisations with fewer than 750 employees while keeping the duty for high-risk processing (COM(2025) 501). Check the version of Article 30 in force on EUR-Lex before relying on any exemption. Either way, a simple record is the easiest proof that you know what your product does with data.

A data protection officer depends on what the product does, not on headcount. Article 37 makes a DPO mandatory when your core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of special-category data such as health data, or of criminal records. A digital health app can qualify with a team of five; a B2B invoicing tool usually will not.

What does a compliant cookie banner need to do?

Block non-essential trackers until the user says yes. National authorities enforce the details, so they vary by country. Italy's Garante, for example, set out in its 2021 cookie guidelines that closing the banner with the X keeps the defaults (no tracking), that scrolling is not consent, that cookie walls are generally unlawful, and that a refusal should not be followed by a new banner for at least six months unless conditions change.

Check the guidance of the authority where most of your users are. The EDPB's data protection guide for small business is a sensible starting point for the basics.

Can you use US cloud, email and analytics tools?

Yes, with a valid basis for the transfer. Since the Commission's adequacy decision of 10 July 2023, personal data can flow to US companies that participate in the EU-US Data Privacy Framework (Commission page); for other vendors you need tools such as standard contractual clauses. The current framework was built in response to the Court of Justice's Schrems II judgment of July 2020, so for critical vendors it pays to know your fallback in advance.

How does privacy by design apply to an MVP?

It means deciding in code, not in the privacy notice, which data you collect. Article 25 asks you to build data protection into the design and to process only what is necessary by default. For an MVP that means no mandatory fields you do not use, roles and permissions from the first release, logs without personal data in clear text, and a real way to delete an account. If your product runs language models over customer data, read our guide to GDPR and LLM apps.

What happens if you have a data breach?

You notify your lead supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk (Article 33). If the risk is high, you also tell the people affected (Article 34). Every breach must be documented, including the ones you do not report. In Italy, notifications go through the Garante's online procedure, which includes a self-assessment tool.

If you are a founder from abroad setting up in Italy, the same rules apply from day one, alongside the company-law steps in our guide to Italian innovative startup requirements. And when you raise, data protection becomes one more item in due diligence, next to code and contracts: see our seed round guide.