> As a founder, the cruel business logic very much favors removing support/refusing to onboard European users. Do it, that's fine. I'd prefer to know if you ca

> As a founder, the cruel business logic very much favors removing support/refusing to onboard European users. Do it, that's fine. I'd prefer to know if you can't be trusted with my data. People whined about HTTPS, it was often an afterthought. Now you wouldn't dream of submitting stuff via HTTP. GDPR will be the same, just on a business level instead of a technical one. > What if a user enters in PII in a field that you thought should have no PII in it? > What happens if you delete the user and restore from a 5 day old backup? > What if they enter PII in table entries owned by other users through that other users account? A lot of these are a red herrings, put in there to muddy the debate. Mistakes happen, the GDPR "punishments" acknowledge that. On the other hand, many companies already treat free-form user entered text as sensitive information. Everybody who's been neglecting privacy will have a bad time adopting this. Technical debt or over-complicated systems will also make it harder, but that is also to be expected. > How do you ensure your third party API partners are in compliance? If I had to guess, for many companies outside the EU, this is going to be the biggest issue.