Depends on the country. For instance in Europe, GDPR enforcement is way more lenient towards small companies, to the point where it makes no strategic sense for

Depends on the country. For instance in Europe, GDPR enforcement is way more lenient towards small companies, to the point where it makes no strategic sense for a startup to invest anything but the bare minimum required to feign "good intentions". Striving for actual compliance with the letter of the law is something only huge companies do.