In your first 90 days under GDPR, map the personal data you hold, fix your privacy notice and processor contracts, and write a breach routine that can meet the 72 hour notification limit. Then decide whether you need records of processing, a data protection impact assessment or a data protection officer.
This is a planning guide, not legal advice. Safeguard does not certify anyone for GDPR, and no tool does. Talk to counsel for decisions that carry legal weight.
Days 1 to 30: find out what you have
You cannot protect or explain data you have not listed. Make a simple register: each system, what personal data it holds, why you collect it, who can see it, where it is hosted and how long you keep it.
Include the quiet places. Support inboxes, analytics tools, spreadsheets exported for a one-off task and log files all hold personal data.
Article 30 of the regulation sets what a record of processing must contain: purposes, categories of data subjects and data, recipients, transfers outside the EU, retention limits where possible and a general description of security measures. It also says the duty does not apply to organisations with fewer than 250 people, with exceptions. Those exceptions apply if the processing is likely to risk people's rights, is not occasional, or includes special categories of data. Most startups process data regularly, so plan to keep the record anyway.
Days 31 to 60: fix the paper and the plumbing
Notices. Article 13 requires you to give people information when you collect their data. Check that your privacy notice names who you are, why you process data, and who receives it.
Processors. List every vendor that handles personal data for you. Article 28 expects a contract with each processor. Ask vendors for their data processing terms now, not during a customer audit.
Security. Article 32 asks for appropriate technical and organisational measures. For a small team, that means access control with multi-factor authentication, encryption in transit and at rest, backups you have tested, and a patching routine. Scan your own dependencies and secrets, since a leaked key is also a data breach waiting to happen.
Days 61 to 90: prepare for the bad day
Article 33 says that after a personal data breach, the controller must notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware, unless the breach is unlikely to risk people's rights and freedoms. A processor must tell the controller without undue delay. You must document every breach, even ones you do not report.
Write a one page routine: who decides, who calls the authority, what facts you collect first. Practice it once.
Article 34 adds a duty to tell affected people when the risk to them is high. Encryption that makes data unintelligible can remove that duty, which is one more reason to encrypt.
Do you need a DPIA or a DPO?
Article 35 requires an impact assessment before processing that is likely to cause high risk. It lists automated profiling with legal or similarly significant effects, large scale processing of special category data, and large scale monitoring of public areas.
Article 37 requires a data protection officer for public bodies, for organisations whose core activity is large scale regular and systematic monitoring of people, and for those whose core activity is large scale processing of special category data. Many startups are not in these groups, but a behavioural analytics or health product might be.
What to do
- Build the data register, covering every system and vendor.
- Decide whether you keep an Article 30 record, and start it.
- Update the privacy notice to match what you actually collect.
- Collect processing agreements from every vendor.
- Turn on multi-factor authentication and encryption, and test a restore.
- Write and rehearse the 72 hour breach routine.
- Screen new features for DPIA triggers before launch.
- Decide, in writing, whether you need a DPO and why.
Quick check
Does a small startup need records of processing?
Article 30 exempts organisations under 250 people unless the processing is risky, not occasional, or involves special categories. Regular processing usually removes the exemption.
When does the 72 hours start?
It starts when the controller becomes aware of the breach, and the notice is due where feasible within that time unless the breach is unlikely to risk individuals.
Sources
Last reviewed: 18 October 2026.
