Data protection
for startups

Yes. The GDPR has no minimum thresholds for turnover, number of employees or age of the business. From the moment a startup collects data from users, leads or employees, it becomes a data controller with all the associated obligations: informing individuals, documenting activities and protecting data. Building on solid foundations from the outset is more efficient than remedying issues later.

Privacy by design (art. 25 GDPR) is the obligation to incorporate data protection into product design from the outset, not as an afterthought. It means collecting only the data necessary, using minimal permissions, allowing users to control their data and configuring the most restrictive options by default. For a startup, integrating these principles from the MVP avoids costly architectural revisions at later stages.

Yes. Waiting lists collect email addresses from interested individuals. Even before the product exists, the startup is already processing personal data and must inform those registered of how their data will be used, for what purpose it is retained and for how long. Subsequent communications to that list also require a valid legal basis (typically the consent given when signing up).

Only in anonymised or aggregated form. During the due diligence process, investors may need access to user metrics, but must not access identifiable personal data without an adequate legal basis and without informing users. NDA agreements during due diligence should include specific data protection clauses.

Yes, with all providers that process personal data of the startup's users or employees on its behalf: email marketing, CRM, analytics tools, support platforms, cloud hosting, etc. Most major providers (Google, AWS, HubSpot, etc.) offer their own DPAs accepted online, but the startup must ensure these have been formally executed. The use of US-based providers may involve international data transfers; the legality of such transfers is typically based on the provider's adherence to the EU-US Data Privacy Framework (DPF) or on the adequate safeguards under art. 46 GDPR.

A DPIA is mandatory when the processing is likely to result in a high risk to the rights and freedoms of individuals (art. 35 GDPR). The most common scenarios for startups are: large-scale profiling, processing of special category data (health, biometrics), systematic monitoring of individuals, or processing of children's data. A healthtech, fintech or adtech startup must assess whether its data model requires a DPIA.