GDPR in 90 Seconds: The Three Things That Actually Matter
Most GDPR guides give you every article. What you actually need is three things: whether it applies to you, what data you collect, and what you do when something goes wrong.
1:24
Transcript
Most founders read a GDPR guide and feel like they need a legal team and six months. You don't. There are three things that actually get companies fined — and everything else is noise until you have those three covered.
First question: does it even apply to you? If you collect data from EU users — even one — and you're processing or storing it, GDPR applies. Full stop. It doesn't matter where your company is incorporated. It doesn't matter if you're a startup. If you're serving EU residents, you're in scope. Most B2B SaaS products are. If you're not sure, talk to counsel — but assume yes.
Assuming it applies, here are the three obligations that actually show up in enforcement cases. One: you need a lawful basis for every data point you collect. Not a generic privacy policy — a specific legal basis per purpose. Two: if there's a breach, you have seventy-two hours to notify the relevant authority. That clock starts when you become aware. Three: users can ask you to delete their data. You have to be able to do it. If your data model makes that technically impossible, fix it now — not when someone asks.