A solid answer would depend on: - what it is your startup does - how you process user data - what third parties - if any - you draw upon to process that user

A solid answer would depend on: - what it is your startup does - how you process user data - what third parties - if any - you draw upon to process that user data If you process any user data at all (of users currently located in the EU, that is) the very least you need is: - a privacy policy - a list of your data processing activities - a list of your technical and organisational measures for protecting user data - a data processing agreement with every third party that processes user data on your behalf