Estimating the GDPR Impact on Startups in UPTEC

Abstract

The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for collecting, processing, and storing personal information from residents of the European Union (EU). The regulation applies to all companies, of any magnitude, that collect or handle information from European Citizens. This work aims to understand how the GDPR might negatively affect startups in Northern Portugal by either raising costs, hindering innovation, or placing barriers to the accelerated growth this type of company usually seeks. Using an online questionnaire, we inquired startup founders, c-level managers, and senior managers about the experience of their companies regarding the road to compliance with the GDPR and its impact on their business. We conclude, given the limitations of the study, that the regulation tends to create additional costs for startups, although not at a very significant level. In the innovation spectrum, the conclusion is that management often weighs the need to comply with the GDPR when ideating new products or services - the tendency, however, is not to discard any ideas exclusively because of the risk of non-compliance. Regarding growth, the GDPR is not seen as a blocker for growth for most companies, either because they tend