GDPR Compliance for Startups: 12-Point Checklist

August 16, 2022

If you just launched your startup and are looking to target EU residents, the first thing you must do is comply with the EU's General Protection Regulation or simply GDPR. This regulation is a set of rules for how you can collect and process customers' personal data. Besides, it states the fines and penalties that would be applied if you fail to comply with these rules.

But what does GDPR really mean? And is GDPR compliance for startups a real nightmare?

It means more safety and transparency for customers, but for companies, it means more stress and work. GDPR went into effect in 2018, but it is still a challenge for many businesses, especially small ones and startups.

How can you make the process of GDPR compliance stress-free for your startup? Our 12-point Checklist will help you out. Just read on.

Unfortunately, many companies today do not care about the data they receive from customers. The situation is so because employment of numerous regulations is quite a big challenge. This process is even harder for startups as you have to juggle many things at the beginning — launch new products and build your team while also looking for investors.

However, there is good news, too. As a startup at an early stage of business, you can build and implement the GDPR-compliant data processing practices from the start and don't need to make any changes to your existing ones because you have none.

So, does the process of GDPR compliance have any differences compared to the one for big companies? Mostly, no. However, being a startup, you get two main benefits up the sleeve:

If your startup has less than 250 employees, you do not need to have and manage data inventory and record your data processing. This is true if there are no security risks in data processing to the rights of individuals or it doesn't involve processing some extra types of data like sex, origin, political opinions, etc. To learn more on this matter, you can study the ICO guidelines.
You don't need to hire Data Protection Officers (DPOs) as you don't process large amounts of personal data. However, if you want to scale in the future, DPO is a must.

It is critical for a startup to comply with GDPR, or you may face large penalties. Just imagine, you can be fined up to 20 million euros or 4% of your revenue (!) And that's not for what you are desiring. Right?

Regulation GDPR

Understand the Principles of Data Processing

There are six rules of GDPR that are described in Article 5 that your business must follow. Mainly if you process the personal data of your customers. They are the next:

Lawfulness: all the data must be processed transparently and lawfully;
Purpose limitation: you should have a clear and specific purpose for collecting customers' data;
Data minimization: you must collect only the data to achieve your objective and not more;
Accuracy: you should ensure that the collected data is accurate;
Storage limitation: you should not keep the data longer than it is necessary;
Integrity: you must protect data confidentiality.

Your startup as a data collector must follow all these rules and principles when collecting personal data.

1. Data mapping

Data mapping is the first thing you need to do to be compliant with GDPR. You should categorize all the data you collect and where it is stored and check whether you collect any sensitive data from your users. If so, you have to conduct extra provision that consists of parental consent, Data Protection Impact Assessment, or hire a Data Protection Officer.

Usually, data mapping consists of the following information:

The type of data you collect;
Answering the question: 'Is this data personal or sensitive?';
Does the data comply with six GDPR legal bases (we will talk about them in the next point);
The purpose of data collection;
The place where the data is stored;
How long the data is stored;
What protective measure do you use to store the data;
Where you transfer your data;
The locations of third-party recipients;
The protocols used for data protection during transferrin.

2. GDPR legal requirements

To process personal data, your startup needs to have a certain, and most importantly, lawful reason for it. In Article 6, you can find six main legal bases for the processing of data with GDPR compliance. You can only process the personal data of your customers if:

Customers give you consent to use their data for a specific purpose;
Need this data for conducting a contractual duty;
Processing the data is the only way to comply with a legal obligation;
You perform a task in the public interest;
The processing of data is needed to follow the legitimate business interest;

To put it simply, you need to have a legal basis for collecting personal data; otherwise, you are not allowed to do so.

3. Limited data collection

As we already told you, cutting down on data collection is the foundation of the GDPR rules. This rule mandates GDPR compliance startups to periodically conduct reviews and delete information that is no longer necessary. So basically, the less data you collect, the easier it is for you to be GDPR-compliant.

4. Active opt-in for forms

If you want to become GDPR-compliant, you must make sure that all the contact forms on your website are transparent. You are not just collecting some data. You have to justify that you ask users for some information.

Moreover, if you use subscription contact forms, they must have a tick box or opt-in. This will ensure that a user has accepted the Terms of your website usage and agreed to get contacted.

5. Clean mailing lists

To be GDPR-compliant, you need consent to be opt-in. For example, if you used to buy email lists, you must make sure that users from that list have given consent; otherwise, you will violate GDPR rules. In case they didn't, you need to unsubscribe them from your email address list.

6. Double opt-in in emails

You had better include double opt-in for all the new signups and ensure all your customers consented to get into your email list. This means that unless a user consented twice, they wouldn't be added to your email list. The first consent is given after completing the signup form, and the second one is via a confirmation link sent in an email after filling in the form.

Although double opt-in is not mandatory, you should definitely add it as it shows your dedication to the data protection principles stated in the GDPR.

Emails

7. GDPR compliance of your CMS and plugins

Another step is to ensure that the CMS and plugins you use are also GDPR-compliant. Luckily, popular CMS systems like WordPress, Joomla, Wix, and a couple more have built-in GDPR compliance instruments. However, if your current CMS doesn't support it, you can add yourself a custom code, plugin, or software to become GDPR-compliant.

Besides, do not forget about the plugins you use. For example, some WordPress plugins use personal data and even have their cookies. So, make sure they are all compliant with GDPR rules. What is more, do not forget to add the plugins you use to your privacy policy.

8. Secure data storage

All the data you process and collect must be stored within the EU or subject to EU privacy laws. You can use cloud-based software such as Dropbox, Salesforce, WeTransfer, and others but make sure what type of data these tools can access. Of course, there won't be any problems with huge brands like Google and Microsoft, as they have data centers all over the globe. However, if you use other cloud vendors, make sure they comply with GDPR.

Data Security

9. Data access and portability

GDPR has a right to access personal data for users as well as ask for other privacy rights like rectification, transferring of data, and deletion. Users can request their personal data via Access Request forms (DSAR) offline or using email.

What is more, the right to request personal data and store it is called data portability, and your startup must provide a user with the ability to download their personal data and transfer it. So, you need to make sure that you have a system that can provide users with a downloadable file (in CSV, XML, or JSON formats) and be able to erase the user's data on request.

10. Privacy policy

To become GDPR-compliant, you have to update your existing privacy policy and make sure you are transparent about the data processing.

What should be included?

First, you need to clarify the details of a data controller (such as identity, address, and contacts) and add details of your DPO if you have one.
Second, you need to specify: all the types of data you collect, the purpose of its use, the legal basis for processing data, the time of data storage, cookies policy, data transferring peculiarities, plugins used, and third parties if you shared data with them.

Of course, the privacy policy is technical documentation, but make sure it is understandable and written in simple language. You can also add the link to it in your consent form.

11. A cookie pop-up or banner

According to the GDPR, cookies can be considered a personal data collector because they store the data others might use to identify a person. That is why you have to receive consent to use any cookies on your website (except for strictly necessary ones). The GDPR requirements for cookies are the following:

You must receive consent from a user before cookies usage;
You have to state which user data your cookies are collected clearly;
All the users' consents have to be documented and stored;
If cookies are not allowed, your website must function properly;
Users must have the right to withdraw cookies' consent.

12. Protection from data breaches

Data breaches are one of the key reasons for fines under GDPR, so you have to protect user data at all costs. The General Data Protection Regulations require the appropriate security measures to be applied so that user data won't be compromised or given unauthorized access. Among the technical measures approved by GDPR are:

Risk analyses and DPIAs for identifying any potential threats;
Data Protection Policy;
Data encryption;
Using security software;
Data protection training for staff.

Surely, when adopting GDPR, your startup can face numerous challenges. Besides, setting everything up is not enough as you must constantly monitor its compliance and update if necessary. Even DPO can guarantee you 100% success.

However, this won't be a problem for a special GDPR compliance app by GrowthDot. This smart data protection tool for your Zendesk help desk ensures that your startup is GDPR-compliant so that you can rest assured that you won't be fined. Besides, you can delete and anonymize user data in accordance with the EU and Californian regulations.

GDPR Compliance

So, to sum up, here are the key statements of what GDPR means for your startup:

If you work in any EU country, collect and process personal data of its residents, the GDPR is applied to you, either. No matter whether you are a startup, small, or new business.
The fundamental principle of the GDPR is that you can only collect and process data if you have a clear legal basis for this.
Users should be able to make an informed choice of giving consent for using their personal information.

Becoming GDPR-compliant is not the easiest task. However, our simple 12-point GDPR privacy policy checklist will definitely help you move in the right direction.

GDPR Compliance for Startups: 12-Point Checklist