This article is for startup founders and business owners who collect customer data and need to understand GDPR compliance requirements.
If you're wondering whether GDPR applies to your business, what you need in a privacy policy, or how to handle customer data requests legally, this guide covers the essential rules, required documentation, and practical steps to avoid penalties up to €20 million.
Key Takeaways
• You need a privacy policy from day one of collecting any personal data, including IP addresses from website analytics.
• GDPR fines reach up to €20 million or 4% of annual global turnover for non-compliance, whichever is higher.
• You must respond to data subject access requests within one month and search all systems containing their data.
• Data breaches require notification to the Data Protection Commission within 72 hours of becoming aware of the incident.
• Consent must be freely given with separate checkboxes for different purposes—you cannot bundle necessary and unnecessary processing together.
Laura Ryan is a practising Barrister at the Bar of Ireland. She graduated from the Honourable Society of King’s Inns in 2024, having previously qualified and practised as a Chartered Accountant in a big four accounting firm.
Do I need GDPR compliance if my startup is based outside the EU?
Yes, GDPR applies to any company processing personal data of EU residents, regardless of where your business is located. This means US companies, Irish startups, and international businesses with EU customers must all comply with GDPR requirements.
Do I need a privacy policy from the moment I launch my website?
Yes, you need a privacy policy from day one of collecting any personal data. Article 13 requires providing privacy information at the time you collect data—whether through contact forms, newsletter signups, or even website analytics that capture IP addresses.
What counts as personal data under GDPR?
Personal data includes any information relating to an identifiable person, extending far beyond names and email addresses. This includes IP addresses, cookie identifiers, location data, device fingerprints, browsing history, purchase patterns, and app usage analytics when linked to individuals.
Can I ask users to consent to everything at once to make it simpler?
No, you cannot bundle consent for different purposes together. GDPR requires specific, granular consent with separate checkboxes for distinct activities like marketing emails, analytics tracking, and third-party data sharing—users must have genuine choice for each purpose.
How long do I have to respond to someone requesting their personal data?
You must provide the requested information free of charge within one month. This includes copies of their data, processing purposes, recipients, retention periods, and the source if you didn't collect it directly from them.
What happens if my startup experiences a data breach?
You must notify the Data Protection Commission within 72 hours of becoming aware of the breach through their online system at dataprotection.ie. If the breach poses high risks to individuals (like exposed financial information or sensitive data), you must also notify the affected individuals directly.
Can I keep customer data indefinitely for future use?
No, you cannot keep data indefinitely—you must specify retention periods for different data types in your privacy policy. State clearly how long you retain customer accounts, transaction records, marketing lists, and analytics data based on legitimate business needs.
What are the actual penalties for GDPR non-compliance?
The Data Protection Commission can issue fines up to €20 million or 4% of your annual global turnover, whichever is higher. Beyond financial penalties, violations damage your reputation and erode customer trust, which can be even more costly for startups.
Do I need to update my privacy policy when I add new tools or features?
Yes, your privacy policy requires updating whenever your data practices change. Adding new analytics tools, integrating third-party services, launching features that collect additional data, or changing how you use existing data all require immediate privacy policy updates.
