Tell that to GitHub for instance: https://github.blog/2020-12-17-no-cookie-for-you/
And for a startup it's trivial to comply with GDPR because:
- you start from scratch, so you know not to collect more data than you need
- you don't need that much data to begin with
Edit: In addition with AI act and its very broad definition of what an AI is and a classification like "Education" you might end up in level "highest risk" just for calculating statistics on your quiz app (no one knows until a court rules). With Cyber Resilience Act and its application of the (physical) supply chain direction, your open source repo from 5 years ago might end up being a footgun with you being personally accountable for other companies using it in their product. And so on...
Even a cash-only business with no electronics anywhere would still need nontrivial GDPR compliance efforts because it has employees. Just because you need the data to run your business doesn’t automatically make you exempt without further paperwork. Your lawyers definitely do occasional GDPR compliance work.
https://www.dickinson-wright.com/news-alerts/the-gdpr-covers...
It’s a bit like accounting. You can structure your business operations is ways that make the accounting easier or harder, but unless you shut the business down you will always have done enough somewhere to need to think about (and probably file paperwork for) accounting/GDPR.