A GDPR request can be quite a challenge for any company that doesn't have fully automated processes in place. I guess it's often not malice, but rather "we hav

A GDPR request can be quite a challenge for any company that doesn't have fully automated processes in place. I guess it's often not malice, but rather "we have no clue in which SaaS we might have your personal data, don't want to drop everything for a week in order to figure it out and simply hope that you won't sue us if we don't reply". So if you want to screw over an early stage startup: 1. Buy their product, use everything on their website where you can leave your personal data (newsletter, chatboxes, send an email,...). Document the requests that are made. 2. Request your data according to GDPR. Preferably by mail. 3. Take a lawyer and sue them if you find any inconsistencies. 4. Rinse and repeat until they've either fully automated the process or are out of business.