Most founders meet GDPR at the worst possible moment: a promising enterprise customer sends a Data Processing Agreement and a security questionnaire, and suddenly you need answers you don’t have — with a deal on the line. The good news is that the fundamentals are manageable if you get to them early. The important thing to understand: GDPR is fundamentally technical. It’s about how your systems actually collect, store, share, and delete personal data — not a PDF you sign once.
(This is practical guidance, not legal advice — but most of what trips startups up is engineering, not law.)
First: does it even apply to you?
Almost certainly, if you have any European users, customers, or leads — regardless of where your company is based. GDPR follows the data subject, not your headquarters. If you sell into or market to the EU or UK, assume you’re in scope.
The practical checklist
1. Know what personal data you hold, and where it flows. You can’t protect or delete what you haven’t mapped. List every place personal data enters (signup, forms, analytics, support), where it’s stored, and every third party it’s shared with. Most teams are surprised by how long this list is.
2. Map your third parties and sub-processors. Every tool that touches user data — analytics, email, payments, support, your cloud provider — is a processor you’re responsible for. You need to know who they are and that they’re covered by proper agreements.
3. Have a lawful basis, and handle consent honestly. For most SaaS this is “legitimate interest” or “contract,” with consent for things like marketing and non-essential cookies. Pre-ticked boxes and cookie walls that don’t take “no” for an answer are exactly what gets flagged.
4. Be able to answer data-subject requests. Users can ask to access or delete their data. Can you actually find and delete everything about one person, across every system, if they ask? If that would be a scramble, that’s a gap.
5. Set data retention and deletion rules. Keeping personal data forever “just in case” is a liability, not an asset. Decide how long you keep things and actually delete on schedule.
6. Secure the processing. Encryption in transit and at rest, sensible access controls, no personal data in logs or in the browser it doesn’t belong in. GDPR expects “appropriate” security — and a breach of unsecured personal data is the expensive scenario.
7. Have the paperwork ready. A clear privacy policy that matches what you actually do, a record of processing, and a DPA you can offer customers. When an enterprise buyer asks, having these ready is often the difference between closing and stalling.
Why an engineer should look, not just a lawyer
A lawyer can tell you what the rules require. But whether your system actually complies — whether data really flows where your policy says, whether “delete my account” truly deletes everything, whether a third party is quietly receiving more than it should — is a question about your architecture. That’s where the real exposure hides, and it’s exactly what a checklist-only, paperwork approach misses.
Getting the basics right early is dramatically cheaper than scrambling under a deal deadline — or explaining a breach you weren’t prepared for.
If a customer is asking for a DPA, or you just want to know where you actually stand, my GDPR & data-protection audit maps your real data flows against GDPR and gives you a prioritised path to defensible compliance — plus evidence you can put in front of the customer asking. Book a free intro call to get started.