ROPA
A Record of Processing Activities that maps every business activity to data categories, legal basis, retention, and the supporting vendor chain.
GDPR for startups
GDPR-ready without burning your roadmap.
An operational privacy program built for a startup-sized team: the records EU buyers actually ask for, the workflows that survive contact with engineering, and a documentation footprint you can maintain after we leave.
- All 99 GDPR articles triaged — required, optional, non-operational.
- Records that pass enterprise procurement on the first read.
- Lean enough that your founding team can maintain it.
- ROPA + processor register
- DSAR workflow
- Transfer assessments
- DPA library
When this is for you
The four moments GDPR stops being theoretical.
-
An EU customer just sent you their DPA and a 60-question vendor review.
Procurement won't move without a Data Processing Agreement, a transfer mechanism, and a credible processor register. You have a deadline. You don't have the records.
-
You just hit your first regulator-style request.
A user asked for their data, or a regulator inquired about a feature. You need a DSAR workflow that actually finds, exports, and deletes — and a paper trail that defends what you did.
-
You're moving from "EU users exist" to "EU is a serious market".
Different bar entirely: SCCs, transfer impact assessments, cookies and tracking review, consent records, retention enforcement, DPO question. We turn the list into a program.
-
You inherited a privacy document zoo.
Five overlapping policies, three legacy DPAs, a privacy page that doesn't match the product. We collapse it into one source of truth, kept current as the product changes.
What gets built
A working privacy program — not a binder.
Every artifact lives in tools your team already uses. Every record has a named owner. Every workflow has a tested path through engineering.
Processor register
Every subprocessor, what they do, where the data sits, the contract that governs them, and the review cadence.
DPA library
One incoming DPA template you can sign, one outgoing DPA you can issue, mapped to your processor register so updates propagate.
Transfer mechanisms
SCCs in place where required, Transfer Impact Assessments on file for the third-country flows that need them.
DSAR workflow
End-to-end: intake, identity verification, data location, export, deletion, regulator-ready audit trail. Tested before you need it.
Consent & cookies
A consent model that fits your product (B2B SaaS, marketing site, in-product features) and survives a cookie audit by a serious EU buyer.
Privacy notice + product copy
A privacy notice that matches what your product actually does — and the in-product strings (consent prompts, signup, account settings) that line up with it.
Breach & regulator playbook
Who decides, who notifies, what gets logged, what gets sent to the supervisory authority within 72 hours — written before the bad day, not during it.
The engagement
Fixed scope. Six to eight weeks. Clean handover.
- 01
Discovery & gap map Week 1
One week of interviews and data-flow walk-throughs. You receive a prioritized gap map, classified by enterprise-buyer impact and regulator risk.
- 02
Build & operationalize Weeks 2–7
ROPA, processor register, DPA library, DSAR workflow, transfer assessments, consent model. All built inside your existing tools, with named owners.
- 03
Handover & rhythm Week 8
Quarterly review cadence in place. Internal owners trained. A 30-day post-handover support window included.
From the practice
"The biggest mistake startups make with GDPR is treating it as a compliance project. It isn't. It's a product and operations program with regulatory consequences. Build it that way and procurement, audit, and incident response all stop fighting each other."
— Adam Gresh, Purple Dragon Cybersecurity
Frequently asked
Common questions, direct answers.
Do we need to be GDPR-compliant before we sell into the EU?
If you process EU personal data — which almost every B2B SaaS does — yes. Larger EU buyers will block procurement on missing records (ROPA, DPA, transfer mechanism). The practical bar to clear procurement is achievable in 4–8 weeks for most startups.
Isn't this what our lawyer does?
Counsel writes the policy. We make the policy operational — the workflows, the registers, the system changes, the audit trail. We work alongside your existing privacy counsel rather than replacing them.
What if we have US users too?
We handle the EU side and align it to the patchwork of US state privacy laws (CCPA/CPRA, etc.) so the same workflows answer both. One DSAR pipeline, one consent model where possible, one set of records.
Will we need a DPO?
Most startups do not need to formally appoint a DPO. We help you assess whether you fall under the trigger conditions (large-scale monitoring, special-category processing), and if not, we structure governance so a DPO is a hire you can defer.
Get a free 30-min GDPR review
No deck. We walk your data flows, give you a prioritized gap list, and an honest read on what your next buyer will block on.
Talk to a security operator.
Tell us what you're trying to ship, what's stalled, or which buyer security review is up next. We work with companies across the EU, EEA and US — and we reply within one business day.
- info@purpledragoncyber.com
- +31 10 899 8719
- Nicolaas Beetsstraat 216, 3511 HG Utrecht