# Building a compliance function before regulators find you first
At a 10-person SaaS startup, "compliance" is a folder in Notion that the founder updates the night before a customer's security questionnaire is due. At a 500-person scale-up, it's a VPVPA clear statement of the benefits your product delivers, the problems it solves and why customers should choose you over alternatives.Voir la définition complète → with a team of six, a dedicated budget line, and a seat in the weekly executive meeting. Somewhere between those two points, a company crosses a line where "we'll fix it later" stops being a strategy and starts being a liability. This lesson is about finding that line before a regulator, auditor, or enterprise customer finds it for you.
At seed to Series A stage, nobody owns compliance full-time. The CTO handles security because they set up the AWS account. The founder handles privacy because they wrote the privacy policy off a template. This works, barely, because:
But even here, three legal obligations exist from day one, regardless of headcount:
1. Data protection law applies immediately. If you have a single EU user, the GDPR (General Data Protection Regulation, EU law effective 2018) applies. If you have a single California resident, the CCPA/CPRA (California Consumer Privacy Act, amended by the California Privacy Rights Act) applies. There is no "too small to comply" exemption for the core obligations, only reduced scope for some requirements (e.g., Data Protection Officer thresholds).
2. Security representations are contractual, not aspirational. If your terms of service say "we encrypt data at rest," that's now a legal claim the FTC (Federal Trade Commission, the US consumer protection regulator) can act on under Section 5 of the FTC Act if false.
3. Payment handling triggers PCI DSS (Payment Card Industry Data Security Standard, a private-sector security standard, not a law, but enforced via card network contracts) the moment you touch card data directly, even indirectly through a form.
By scale-up stage, the same company likely has enterprise customers who demand a SOC 2 Type II report (Service Organization Control 2, an audit standard from the AICPA, the American Institute of Certified Public Accountants, verifying security controls operate effectively over time), sells into regulated industries, and processes data across multiple jurisdictions. The compliance function now looks like:
The shift isn't optional. It's driven by who's buying. A startup selling to other startups can defer this. A scale-up selling to a bank, hospital system, or EU government agency cannot, those buyers will not sign without evidence of controls.
The inflection point isn't a headcount number. It's the moment any of these become true:
| Framework | Who enforces it | What it actually demands |
|---|---|---|
| GDPR | National Data Protection Authorities (DPAs) in each EU country, e.g., Ireland's DPC | Lawful basis for processing, breach notification within 72 hours, data subject access rights, Data Processing Agreements with vendors |
| CCPA/CPRA | California Privacy Protection Agency (CPPA) | Consumer right to know, delete, opt out of "sale/sharing" of data |
| HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation. | US Department of Health and Human Services, Office for Civil Rights | BAAs with covered entities, encryption, access controls, breach notification |
| SOC 2 | Not a regulator, an audit standard (AICPA) | Documented controls across security, availability, confidentiality, tested by an independent auditor |
| PCI DSS | Payment Card Industry Security Standards Council (industry body, not government) | Network segmentationsegmentationDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.Voir la définition complète →, encryption of cardholder data, regular vulnerability scans |
| DORA (EU) | European Supervisory Authorities (EBA, ESMA, EIOPA) | ICT risk management, incident reporting, resilience testing for financial sector vendors |
A useful public primer on GDPR obligations for smaller companies is the UK ICO's guidance for small organisations, which translates the law into checklists.
Vérification des acquis
1. A 10-person startup has one user based in Germany. What is the correct interpretation of their GDPR obligations?
2. Why does a startup's claim in its terms of service that it 'encrypts data at rest' carry legal risk even before any regulator is actively watching the company?
3. What is the core reasoning behind why 'compliance as a side quest' (an engineer or founder handling it informally) works, barely, at the 10-person stage?
4. Select ALL correct answers about legal obligations that apply to a very early-stage startup regardless of headcount.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about the 'line' a company crosses where informal compliance stops being viable, as described in the lesson.
Sélectionnez toutes les réponses correctes.
You don't build a compliance team in one leap. The realistic sequence looks like:
1. Pre-Series A: Assign ownership (even part-time) to one named person. Write a privacy policy that reflects reality, not a template. Use a Data Processing Agreement template for vendors.
2. Series A to B: Start a SOC 2 Type I readiness process (a point-in-time control assessment) if enterprise deals are on the horizon. Appoint a DPO if GDPR thresholds are met. Formalize an incident response plan.
3. Series B and beyond: Hire a dedicated compliance or trust lead. Move to SOC 2 Type II (controls tested over 3 to 12 months). Consider ISO 27001 for EU market credibility. Build a vendor risk management program, because your compliance posture is only as strong as your subprocessors' (e.g., your cloud provider, your analytics tool).
A common mistake: treating compliance as a one-time certification project rather than an operating system. SOC 2 reports expire. Laws change (the EU's AI Act, phasing in through 2026, adds new obligations for SaaS companies embeddingembeddingAn embedding is a numerical vector that represents data (text, images, or items) in a way that captures meaning, so similar items sit close together in space.Voir la définition complète → AI features). A compliance function has to monitor, not just certify.
GDPR Explained in 5 Minutes
Delaying compliance investment doesn't eliminate the cost, it moves it later and adds interest. A company that ignores data mapping until a Series C due diligence process will often discover: customer data mixed with test data in production, vendors without signed DPAs, and no record of what data exists where. Untangling that under deal-timeline pressure costs multiples of what it would have cost to build correctly from month one.