GDPR for Startups: What US Founders Need to Do

The GDPR applies to your US startup if you offer goods or services to people in the EU, or if you monitor what people in the EU do. It does not matter where your company is incorporated or where your servers sit. If neither applies, you are generally outside its scope. If either does, you need a handful of practical habits in place before you launch, and most of them are cheaper to build in from day one than to bolt on later.

This guide walks through how to tell which side of the line you are on, what the law asks of an early-stage product, what real fines look like, and a checklist you can hand to your engineers.

TL;DR

• GDPR reaches US startups that offer goods or services to people in the EU or monitor them. Serving only customers outside the EU, without targeting the EU, keeps you out of scope.
• Company size does not exempt you. Compliance is judged by what you do with data and the risk it creates.
• Learn the seven principles, map the personal data you collect, and decide early whether you are a controller, a processor, or both.
• Maximum fines are up to €20 million or 4% of worldwide annual turnover, but many real penalties against small organizations trace back to weak security and missing paperwork.
• Build privacy into the product: encryption, access controls, a breach plan, and processor contracts.

Table of Contents

• When GDPR applies to a US startup
• What counts as personal data
• The seven principles in startup terms
• Controller or processor: know your role
• GDPR fines: what actually gets penalized
• A practical checklist for launch and growth
• GDPR for SaaS: what buyers will ask
• Our perspective
• Build privacy in from the first release
• FAQ
• Sources

When GDPR applies to a US startup

The European Commission’s guidance is clear on the trigger. The regulation covers a company based outside the EU when it offers goods or services to individuals in the EU or monitors individuals in the EU. The same page says it does not apply when a non-EU company serves only customers outside the EU and does not specifically target people in the EU.

In practice, ask yourself these questions:

• Can people in EU countries sign up or buy, and do you want them to?
• Do you price in euros, translate the product into EU languages, or advertise to EU audiences?
• Do you run analytics, session recording, or ad pixels that track visitors who are in the EU?
• Do you process data for a business customer that has EU users?

A yes to any of these means you should treat GDPR as applicable until a lawyer tells you otherwise. A US-only B2B tool with no EU marketing, no EU customers and no EU targeting is usually in a different position. Law firms describe this as a risk-based assessment of whether you specifically target EU individuals, not a simple yes or no based on a stray visitor from Berlin.

The edge cases are where founders get stuck: a free tier open to the world, a SaaS product sold to a US company whose staff are in Europe, or a mobile app listed in every app store. If you are in one of those gray areas, spend an hour with a privacy attorney. It costs far less than guessing wrong.

Size does not protect you

A common myth is that GDPR is for big companies. The Commission states that even for small and medium-sized businesses, compliance depends on the nature of your activities and the risk, not on headcount or revenue. A two-person startup that processes health data carries more obligation than a large company that stores a few contact names.

What counts as personal data

Personal data is any information relating to an identified or identifiable living person. Names and addresses obviously count, and so do IP addresses. The Commission also notes that data about legal entities, anonymous data, and data about deceased people are generally outside the regulation.

For a software product, that means more than your users table. Think about:

• Account details: name, email, phone, password hashes
• Device and network data: IP addresses, device IDs, cookies
• Usage events sent to analytics or marketing tools
• Support tickets, chat transcripts, and uploaded files
• Billing data and location data

Some categories need extra care. Race, political opinions, religion, health data and biometric data are special categories that are generally prohibited from processing unless a specific exception applies. The Dutch data protection authority also points out that location and financial data are generally considered privacy-sensitive and can affect people more than ordinary personal data. If your product touches any of these, design for it from the first sprint.

The seven principles in startup terms

The Commission lists seven principles in its data protection overview: lawfulness, fairness and transparency; purpose limitation; data minimization; storage limitation; accuracy; integrity and confidentiality; and accountability. Here is what each one means when you are building a product.

Accountability is the one startups skip. Regulators do not only ask whether you protect data. They ask whether you can prove it. A shared document with your data map, your retention rules and your vendor list is a strong start.

Controller or processor: know your role

A controller decides why and how personal data is processed. A processor handles data on the controller’s behalf under documented instructions, as the Commission explains.

If you run a B2C app, you are a controller for your users’ data. If you sell SaaS to businesses that load their customers’ data into it, you are usually a processor for that data, and a controller for your own account and billing data. Many SaaS startups are both, which is why enterprise buyers send security questionnaires and ask for a data processing agreement.

Being a processor does not make you invisible. The European Data Protection Board stresses that controllers keep overall responsibility even when they use processors, which is why they push strong contract terms down to you. And every vendor you pick, from your cloud host to your email tool, becomes your processor. Keep a list, and sign agreements with each.

GDPR fines: what actually gets penalized

The headline number is large: up to €20 million or 4% of total annual worldwide turnover. Those caps apply to the most serious violations, and most startups will never see them. The more useful lesson comes from the conduct behind real decisions.

• Slane Credit Union, Ireland, January 2022. The Irish regulator fined this small lender €5,000 for failing to apply appropriate security measures and reprimanded it for not doing due diligence on its processor. Lesson: vet your vendors.
• Centric Health, Ireland, February 2023. Fines totaling €460,000 followed a ransomware attack because patient data was not adequately secured. Lesson: security is the control regulators examine first.
• Meta Platforms Ireland, September 2024. The regulator found that Meta failed to document personal data breaches involving user passwords stored in plaintext. Lesson: even incidents you contain need a written record.
• Google, France, January 2019. French authorities fined Google €50 million for insufficient transparency and invalid consent around personalized advertising. Lesson: consent screens must be genuinely clear.

The US International Trade Commission adds that enforcement varies by EU member state, with some countries more aggressive than others in investigating US firms. Treat that as a reason for consistency, not for gambling on a lenient regulator.

The pattern across these cases is not exotic. Weak security, missing documentation, careless vendor choices and murky consent are the repeat offenders. All four are things a product team controls.

A practical checklist for launch and growth

You do not need a compliance department to cover the basics. Work through these steps in order.

1. Map your data. List every piece of personal data you collect, where it is stored, which vendors see it, and why you need it. Delete fields you cannot justify.
2. Pick a legal basis for each purpose. Contract, legitimate interest and consent each carry different rules. Write the choice down.
3. Publish a plain-language privacy notice. Say what you collect, why, how long you keep it, who receives it, and how people exercise their rights.
4. Make consent real. Do not load non-essential trackers before a visitor has agreed. Make declining as easy as accepting.
5. Build for user rights. You need a way to find, export, correct and delete one person’s data across your database, backups policy, analytics and support tools.
6. Sign processor agreements. Cover your cloud host, email, analytics, support and payment vendors.
7. Secure the product. The EU’s guidance for small businesses lists data protection by design and by default, staff training, access controls, backups, pseudonymization and encryption.
8. Write a breach plan. A processor must tell the controller without undue delay, and the controller must then notify the supervisory authority within 72 hours if the breach poses a risk to individuals. Decide in advance who investigates, who decides, and who writes the notice.
9. Check cross-border transfers and representation. Ask counsel whether you need an EU representative and what transfer mechanism covers data moving between the EU and the US.
10. Revisit it every quarter. New features, new vendors and new markets change the picture.

Keeping customer data safe in the product

The EDPB’s breach guidance points to the same basics: robust encryption, managed access controls, documented security measures, and staff trained to recognize and report incidents so breaches are caught early. For an app, that translates to:

• Encryption in transit and at rest
• Role-based access, with least privilege for staff and contractors
• Multi-factor authentication on admin and production systems
• Audit logs you can actually search
• Tested backups and a documented restore
• Separate environments, with no real customer data in test

Your auth layer carries a lot of this weight. If you are choosing one, our comparison of Clerk vs Auth0 for SaaS covers the tradeoffs. If marketing wants event tracking, think about where that data flows first. Our piece on Segment vs RudderStack explains how pipeline choices affect cost and control.

GDPR for SaaS: what buyers will ask

SaaS founders feel GDPR through sales. A European customer, or a US customer with European staff, will ask for a data processing agreement, a list of your subprocessors, your breach process, and where data is stored. If you cannot answer, deals slow down.

Prepare a short trust packet: your privacy notice, a standard processing agreement, a subprocessor list, a one-page security overview, and your retention policy. Questions about location of data are common, and our guide to data residency rules for US apps helps you decide what to promise. As you move upmarket, a security attestation often comes next, and SOC 2 for startups lays out a practical path. If you handle health data, the rules go further, and our overview of HIPAA compliance for apps is the place to start.

Our perspective

We build web and mobile products for founders and small businesses, and the same pattern repeats. Teams treat privacy as a legal chore for after launch, then discover that deleting one user’s data means touching six tools and a pile of exports nobody mapped. Fixing that on a live product takes weeks. Designing for it up front takes a few days.

Our advice is simple. Collect less. Know where every field goes. Pick vendors you can sign agreements with. Build the delete and export paths while the data model is still small. None of this slows an MVP in any meaningful way when senior engineers plan it from the start, and it makes enterprise sales and later audits much easier.

We are engineers, not your lawyers. We build the technical controls and the data flows, and we work alongside your privacy counsel on the legal calls, such as whether GDPR applies to you and which transfer mechanism to use.

— Alex

Build privacy in from the first release

If you are launching a product that EU users could reach, it is far easier to build the data map, deletion tools, access controls and logging into the first version than to retrofit them. Our US-based senior engineers handle end-to-end product development with fixed, transparent pricing, and most projects ship in 6 to 10 weeks. Plans start at $1,750 per month for Starter, with Growth at $3,000 and Enterprise at $5,000 per month.

If you want a first version built with privacy designed in, see our MVP development for founders. Already have an app that needs a stronger foundation? Tell us what you have and we will help you plan the next step.

FAQ

What countries fall under the GDPR?

The regulation applies across the EU member states, and the wider European Economic Area follows it as well. For a US startup, the country of the person matters more than your own: GDPR can reach you when you offer goods or services to people in those countries or monitor their behavior.

What data is not protected by GDPR?

Anonymous data, information about legal entities, and data about deceased people are generally outside the regulation, according to the European Commission. Be careful with the word anonymous. If someone can be identified from the data, directly or in combination with other information, it is still personal data.

Does a small startup really need to worry about fines?

Size does not exempt you, since compliance turns on your activities and the risk they create. Real cases show small organizations penalized for basic security and vendor-oversight failures. The practical goal is to show regulators a documented, sensible approach.

Do I need a data protection officer?

It depends on what you do. Large-scale monitoring of people or large-scale handling of special categories of data are the usual triggers. Ask a privacy attorney to assess your case, because the answer changes as your product and user base grow.

Sources

• Application of the GDPR, European Commission
• Data protection explained, European Commission
• Enforcement and sanctions, European Commission
• Chapter 4: Territorial application, White & Case
• What are personal data?, Autoriteit Persoonsgegevens
• Guidelines 9/2022 on personal data breach notification, EDPB
• Secure personal data, EDPB data protection guide for small businesses
• Inquiry into Slane Credit Union, Irish DPC
• Inquiry into Centric Health Ltd., Irish DPC
• Summary of Decision on Meta Platforms Ireland, Irish DPC
• GDPR enforcement briefing, US International Trade Commission

Recommended

• Data Residency for US Apps: What the Rules Require
• SOC 2 for Startups: A Practical Path to Your First Audit

About Let’s Build My App

Let’s Build My App is a US-based AI development agency. We design, build, and launch production-grade custom software using AI coding tools including Claude Code and OpenAI Codex, and we migrate legacy Bubble apps onto AI-coded stacks such as React, Supabase, and Firebase. We are the #1 US-Based Bubble Agency, founded and run by Alex Dow. Book a free strategy call to scope your project.