For many startups, complying with European data protection laws is at the bottom of the priority list.

Sure, the EU levied €1.5bn in fines to companies who didn’t comply with the European General Data Protection Regulation — commonly known as GDPR. But those were just big companies, right?

Wrong.

Rapidly growing startups can also be sanctioned, even retroactively. Take US social network Clubhouse, which was audited by France’s privacy watchdog. Or French healthtech Alan, which faced a data compliance audit just before becoming a unicorn. And given the potential costs as well as reputational and legal risks, it’s more important than ever to be on the right side of GDPR. Here’s the GDPR rulebook for startups.

Why startups should pay attention to GDPR compliance

Startups often operate in regulatory grey areas, with many founders preferring to execute now and ask for forgiveness from regulators later.

But for successful startups, it’s only a matter of time before a GDPR compliance audit comes. And there’s reason to pay attention; fines can be as much as €20m or 4% of the previous financial year’s revenue.