GDPR compliance for startups, run for you

For most startups, GDPR arrives as a data processing agreement from your first EU customer, followed by a security questionnaire. Signing the agreement is easy. Meeting it is the work. This page explains when GDPR applies, what it requires of a startup, what software can automate, and what stays with your team and your lawyers. It is not legal advice.

What is GDPR?

GDPR sets principles for processing personal data, gives individuals rights over their data, and puts direct obligations on both controllers and processors. It is enforced by national supervisory authorities in each EU member state.

Controller or processor: which are you?

• Controller: decides why and how personal data is processed. You are a controller for your own users, leads and employees.

• Processor: processes personal data on a controller’s behalf. You are usually a processor for the data your B2B customers put into your product.

• Sub-processor: a vendor your processing relies on, such as your cloud host. Your customers will want to know who they are.

Which GDPR articles matter most to a startup?

Who needs GDPR compliance?

• Startups established in the EU that process personal data.

• US, Indian and other non-EU companies that sell to people or businesses in the EU, or track EU users’ behavior.

• B2B SaaS companies whose EU customers put employee or customer data into the product.

• AI companies processing prompts, documents or recordings that contain personal data.

• Vendors in the supply chain of an EU company, who will be bound by Article 28 terms.

What does GDPR compliance take?

• Lawful basis and transparency: a documented legal basis for each processing activity and a clear privacy notice.

• Records: a record of processing activities, required for most SaaS companies regardless of size.

• Contracts: data processing agreements with customers and with every sub-processor.

• Security of processing: access control, encryption, logging, backups and regular testing of whether these measures work.

• Breach readiness: a process to detect, assess and report breaches within 72 hours where feasible.

• Data subject rights: handling access, correction, deletion and objection requests.

• International transfers: a valid mechanism when personal data leaves the EU.

What NexusVoid automates vs what you still do

How NexusVoid gets you ready and keeps you ready

NexusVoid runs your security program like an autonomous CISO, and GDPR security readiness is the by-product. If you have no CISO, it acts as one. If you have a CISO or vCISO, it automates most of their work. The loop is Detect, Prove, Resolve, Test, Verify.

• Argus finds and fixes: outside-in like an attacker with no credentials or installs to begin, then inward through code, dependencies, cloud and secrets. Findings are mapped to MITRE ATT&CK, priced in dollars with FAIR, fixed as pull requests, and retested on merge. That is the regular testing Article 32 asks for, with evidence.

• Aegis proves: tailored policies, automatic evidence, a risk register, vendor management, employee security training, a device agent, a trust center that answers customer due diligence, and auditor-ready exports.

• Striker tests: vulnerability assessment and pentest for web, API, cloud and mobile, pay per scan, with a report in under 60 minutes.

Common GDPR mistakes

• Assuming GDPR does not apply because the company is based outside the EU.

• Relying on the 250-employee exemption for records of processing when processing is continuous.

• Signing a customer’s data processing agreement without checking you can meet its security and breach terms.

• Using sub-processors without contracts or without telling customers.

• Starting the 72-hour clock only once the investigation is done.

• Treating GDPR as a privacy policy and a cookie banner, with no security program behind it.

Frequently asked questions

Does GDPR apply to companies outside the EU?

Yes, when you offer goods or services to people in the EU or monitor their behavior there, under Article 3(2). Incidental contact, such as a non-EU traveler using your product while visiting Europe, does not on its own bring you into scope. A US or Indian SaaS company actively selling to EU customers should assume GDPR applies and confirm with counsel.

What is a GDPR data processing agreement?

Article 28 requires a binding contract between a controller and each processor. It must cover, among other things, processing only on documented instructions, confidentiality of staff, appropriate security measures, rules for using sub-processors, help with data subject requests and breaches, and deleting or returning data at the end of the service. Most B2B customers will send you their own version to sign.

How quickly must a GDPR breach be reported?

A controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people’s rights and freedoms. Processors must notify their controller without undue delay. The clock starts at awareness, not when your investigation is finished.

Do small companies need GDPR records of processing?

Usually, yes. Article 30 has an exemption for organizations with fewer than 250 employees, but it does not apply if the processing is likely to result in a risk to individuals, is not occasional, or includes special category or criminal offense data. Most SaaS companies process customer data continuously, so the exemption rarely helps them.

What are the GDPR fines?

Article 83 sets two tiers. The higher tier, for breaches of core principles, data subject rights or transfer rules, goes up to 20 million euros or 4% of worldwide annual turnover, whichever is higher. The lower tier, which covers controller and processor obligations such as security and breach notification, goes up to 10 million euros or 2%.

If an EU customer has sent you a data processing agreement and you want to be sure you can meet it, book a call at /contact and we will walk through your setup.