And complying with the GDPR isn't that difficult as a startup. You can build your systems from the ground up to be able to accommodate GDPR requirements. There is some documenting paperwork you are supposed to have internally, but enforcement is quite lenient if you show good-faith efforts to comply.