A founder meeting GDPR should settle five things early: whether the regulation applies, which lawful basis covers each use of personal data, which vendors are processors with contracts, what records you keep, and who decides during a breach. Everything else can follow as the company grows.
Does GDPR apply to a small company outside the EU?
Scope is set by Article 3. The regulation applies to organisations established in the EU, and also to organisations outside it that offer goods or services to people in the EU or monitor their behaviour there. Where you incorporate is not the test. A US startup with EU customers on a public pricing page should assume it is in scope and confirm with counsel.
What is a lawful basis and why does it come first?
Article 6 lists the grounds that make processing lawful, such as consent, performance of a contract or legitimate interests. Every purpose needs one, and the choice affects what rights people have. Consent has conditions of its own under Article 7, including that withdrawal must be as easy as giving it.
Constructed example: a note taking app collects email to create accounts, uses the same email for product announcements and shares it with an ad partner. Three purposes, three questions. The account email fits a contract basis. Announcements may fit another basis. The ad partner sharing is the one a regulator would look at first, and the one founders forget to write down.
Which vendors become your problem?
Any vendor that processes personal data on your behalf is a processor under Article 28, and you need a binding contract that sets out what they do and what they must do. Payment tools, email platforms, analytics, support desks and AI APIs all qualify when they see personal data. Ask each for their data processing terms before you sign, not after.
Do you need records, a DPO or an impact assessment?
Article 30 requires records of processing activities. There is an exemption for organisations with fewer than 250 employees, but it does not apply if the processing is likely to risk people's rights, is not occasional, or includes special categories of data. Because most products process data continuously, assume you need records.
Article 37 requires a data protection officer in three cases: public authorities, core activities involving large scale regular and systematic monitoring of people, and core activities involving large scale special category data. Many startups do not need one. Article 35 requires a data protection impact assessment before processing likely to create high risk, and the text names large scale special category data and systematic evaluation based on automated profiling as examples.
What does the breach clock mean for a team of eight?
Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk. Decide now who has authority to make that call, and where the contact details of your supervisory authority are written down.
What can go wrong financially?
Article 83 sets maximum fines of 20 million euros or 4 percent of worldwide annual turnover for the most serious infringements, and 10 million euros or 2 percent for others, whichever is higher. These are ceilings. Authorities weigh the circumstances, so a documented good faith effort matters.
What to do
- Confirm scope under Article 3 with a lawyer who handles privacy.
- List every purpose for personal data and pick a lawful basis for each.
- Collect data processing terms from every vendor that sees personal data.
- Start the Article 30 record as a spreadsheet and keep it current.
- Decide whether DPO or DPIA triggers apply, and write down why.
- Name the person who decides on breach notification and their deputy.
Quick check
Is a small team exempt from keeping records?
Article 30 has an exemption for organisations under 250 employees, but it does not apply when processing is not occasional, likely to risk people's rights, or involves special categories of data.
Do all startups need a data protection officer?
No. Article 37 sets three triggers: public authorities, large scale regular and systematic monitoring, and large scale special category data as a core activity.
Sources
Last reviewed: 18 October 2026.
