> Let’s just take one feature: the requirement that you can permanently delete all of your information. Let's take that feature because it's mentioned often, b

> Let’s just take one feature: the requirement that you can permanently delete all of your information. Let's take that feature because it's mentioned often, but it doesn't exist. Read Article 17* carefully yourself. It doesn't say "permanent". It never even says the word "delete". Elementary, My Dear Watson. * https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/ > at an early stage startup with one programmer, you cannot have that one programmer spending two months on compliance. And then here's the other straw man. An early stage startup in the US with one programmer has more to worry about from US regulation than European regulation. Nonetheless, if you want to trade with Europe then reading the ICO guidance on the GDPR for your business should take a couple of hours. > My biggest fear is that all of these complex bureaucratic laws are just raising the bar for doing a startup. There are so many things I care about more than whether you can create a startup with wilful disregard for people's rights. Did you even notice that Equifax* lost control of personal data on pretty much every single American? Your name, date of birth, your SSN. Equifax did this because they are actually incentivised to make their systems as insecure as they can get away with. The only thing you're right about is that real security has real costs, but you're not convincing me that they're not needed. * https://www.sec.gov/Archives/edgar/data/33185/000119312518154706/d583804dex991.htm https://www.sec.gov/Archives/edgar/data/33185/00011931251815...