GDPR Compliance Checklist for Startups: 16 Items (2026)

Deploy a Next.js app to Vercel, accept every default, and your EU users' personal data is processed in Washington, D.C. Vercel's documentation is explicit about it: Functions execute in iad1 "for all new projects" unless you set a region yourself. Nobody tells you at deploy time, and the dashboard doesn't warn you.

That's the shape of most GDPR problems in an AI-built app. Not a missing policy document, but a default nobody chose.

TL;DR

GDPR applies to you if you have EU users, whatever size you are. This checklist covers 16 items across the four areas that actually generate fines: lawful basis, data principles, security measures, and data subject rights. The single highest-value hour you can spend is finding out which regions your host and your database defaulted to, because one of those choices can't be undone later.

The Four Things That Actually Get Fined

Most GDPR checklists are ordered by what's easy to write about. This one is ordered by what regulators actually act on.

The CMS GDPR Enforcement Tracker Report 2026 (cut-off 1 March 2026) ranks enforcement actions by number of fines issued, not by headline value. That distinction matters for a small team, because the billion-euro cases are all ad-tech giants and tell you nothing about your own risk. Ranked by how often a fine is issued:

Insufficient legal basis for processing (Article 6). You collected or used data without a lawful reason you can point to. The most frequent finding in the entire dataset.
Non-compliance with general data processing principles (Article 5). Collecting more than you need, keeping it longer than you need, or not being straight about what you do with it.
Insufficient technical and organisational measures (Article 32). Usually surfaced by a breach. The breach is the trigger, the weak security is the finding.
Insufficient fulfilment of data subject rights (Articles 12 to 22). Someone asked for their data or asked you to delete it, and you didn't answer properly or in time.

Now the useful part. The same report notes that "only very few fines have been imposed for lack of cooperation with the supervisory authority, for cases of insufficient involvement of a data protection officer, missing data processing agreements or lack of appointment of data protection officer."

Read that again if you've been putting off launch over DPO paperwork. The items founders panic about are close to the bottom of the enforcement record. The four above are where the fines land.

This is a ranking of enforcement history, not permission to skip the paperwork. A missing DPA is still a breach of Article 28, and it's the first thing an enterprise customer's procurement team will ask for. It's just not what fines you.

Where Your Data Physically Lives

This section didn't exist in the older version of this checklist, and it's the part that catches AI-built apps hardest. You picked a stack by clicking through a setup wizard. Those clicks made data residency decisions on your behalf.

Vercel defaults to the United States

From Vercel's own documentation on configuring function regions, last updated 11 August 2026:

By default, Vercel Functions execute in Washington, D.C., USA (iad1) for all new projects to ensure they are located close to most external data sources, which are hosted on the East Coast of the USA.

Static assets are served from the CDN edge, so your marketing page loads from Frankfurt. Your API routes don't. Anything that touches a request body, a session, or a database query runs in Virginia unless you say otherwise.

The fix is one file:

vercel.json

{
  "$schema": "https://openapi.vercel.sh/vercel.json",
  "regions": ["fra1"]
}

One caveat worth knowing before you plan around it: on the Hobby plan you get a single region, Pro gets five, and deploying to more regions than your plan allows fails the build before it even starts.

Supabase region is a one-way door

Supabase offers plenty of EU regions, including Frankfurt (eu-central-1), Ireland (eu-west-1), Paris (eu-west-3), and Stockholm (eu-north-1). Pick the wrong one and you're stuck with it.

Each project is provisioned on hardware in the region you chose, so the region of an existing project can't be changed. Supabase's troubleshooting documentation is direct about the remedy: create a new project in the region you want and migrate across. For a live app with real users, that's a maintenance window and a data migration, not a settings toggle.

If you're reading this before you create your Supabase project, stop and pick the region now. This is the only item on the entire checklist that gets meaningfully harder to fix the longer you wait.

Supabase is also refreshingly blunt in its own region documentation that choosing an EU region is "a data-location control, not proof of regulatory compliance." Storing the bytes in Frankfurt doesn't handle your lawful basis, your retention periods, or your deletion endpoint. It just removes one argument.

The DPA you already have

Good news on the paperwork. Supabase's Data Processing Addendum "supplements and forms part of the Supabase Terms of Service," and the DPA states that "the Parties agree that acceptance of the Agreement shall have the same effect as signing the SCCs." You accepted it when you signed up. Nothing to chase.

Most modern developer platforms work this way now. Check each one rather than assuming, but budget minutes for this, not weeks.

The 16-Item Checklist

Four items in each of the four areas that get fined.

Lawful Basis (Article 6) 4

Write down a lawful basis for each data categoryConsent, contract, legal obligation, vital interests, public task, or legitimate interests. One per category of data, chosen before you write the privacy policy rather than backfilled to match it.

Stop relying on consent where contract fits betterYou don't need consent to store an email address that the account itself requires. Necessity for performance of a contract covers it, and it can't be withdrawn out from under your login flow.

Make analytics and marketing consent genuinely optionalIf the app still works when a user declines, consent is real. If declining breaks the product, it was never freely given. This is the single most-fined failure in the dataset.

Keep a record of when and how consent was givenA timestamp, the version of the notice shown, and the specific scope agreed to. Without it you can't prove consent, and unproven consent is the same as none.

Data Principles (Article 5) 4

Delete the columns you never queryOpen your schema and find the fields your AI assistant scaffolded and nothing reads: date_of_birth, phone, full postal address. Every unused personal field is pure liability with no product upside.

Set a retention period per table, then automate itNot a policy sentence, a scheduled job. Soft-deleted rows sitting in your database for two years are still personal data you're processing.

Inventory your processors, including the AI toolsYour host, your database, your email sender, your analytics, your payment provider, and the coding assistant that may have had repository access. List them, note where each stores data, and confirm the DPA.

Publish a privacy policy that matches the actual schemaRead your policy next to your database tables. A generated policy listing data you don't collect, or omitting data you do, is a transparency failure under Article 5 and it's trivially checkable by anyone.

Security Measures (Article 32) 4

Turn on row-level security and verify it with a real requestEnabling RLS without a policy denies everything, which looks like it's working. Enabling it and writing a permissive policy protects nothing. Test both paths with an actual anon-key request.

Get personal data out of client-side code and env varsAnything prefixed NEXT_PUBLIC_ or VITE_ ships to the browser. Service-role keys belong on the server, and we find them in shipped bundles constantly.

Enforce HTTPS and encryption at restBoth are defaults on every major managed platform in 2026. The failure mode is a custom subdomain or a self-managed service quietly sitting outside the setup.

Write the 72-hour breach process before you need itWho decides it's a breach, which authority you contact, and where the affected-user list comes from. Seventy-two hours starts when you become aware, not when you finish investigating.

Data Subject Rights (Articles 12 to 22) 4

Ship account deletion in the productNot a support email address. A button. If deletion requires a human to run SQL, it will slip past the one-month deadline the first time you're busy.

Make deletion reach every copyBackups, your analytics tool, your email platform, your support inbox, and any warehouse you sync to. A deletion that only clears the primary database is incomplete.

Provide an export in a machine-readable formatJSON or CSV covering everything tied to that user. Portability is a separate right from access, and one endpoint can satisfy both.

Answer within one month and log every requestArticle 12 gives you one month, extendable by two for genuinely complex cases. Keep a record of what was asked, when, and what you sent.

Start With the Two Irreversible Ones

If you only act on this page once, do the two things that get harder with time.

Check your Supabase region. Check your Vercel function region. Everything else on this list is a Tuesday afternoon of work whenever you get to it. Those two are architecture, and one of them can't be changed at all once you have users.

The rest of GDPR, honestly, is a reasonable description of how you'd want your own data handled.

Does GDPR apply to my startup?

If you collect personal data from people in the EU, yes. GDPR applies regardless of where your company is based, and there is no small-company exemption. The only thing that scales with size is how much paperwork you need behind the obligations, not whether they apply.

Is Vercel GDPR compliant?

Vercel offers a DPA and Standard Contractual Clauses, so it can be used compliantly. But compliance is not a property of the host, it is a property of your configuration. Vercel Functions default to the iad1 region in Washington, D.C. for all new projects, so unless you set a region your EU users' data is processed in the United States.

Can I change my Supabase project's region later if I picked the wrong one?

No. A Supabase project is provisioned on hardware in the region you chose, so the region cannot be changed on an existing project. The supported path is to create a new project in the region you want and migrate the data across.

Do I need a Data Protection Officer?

Almost certainly not. A DPO is required only if your core activities involve large-scale processing of special-category data or systematic monitoring of individuals. The CMS GDPR Enforcement Tracker Report 2026 notes that very few fines have ever been issued for failing to appoint one, which makes it a poor place to spend your first compliance week.

What actually gets small companies fined?

By number of fines rather than headline value, the top categories are processing without a sufficient legal basis, breaching the general data processing principles, inadequate security measures, and failing to honour data subject rights. Missing paperwork like a DPA or a DPO ranks near the bottom.

Check What Your App Actually Exposes

A scan finds the client-side keys, permissive database policies, and missing security headers that turn into Article 32 findings.