GDPR sounds like a problem for lawyers and large companies, until your first app has a signup form and a database, at which point it is already a problem for you. The rule applies the moment you hold personal data from anyone in the EU, regardless of how small the company behind it is, and regardless of whether you have ever heard of the regulation at all. Building the app was the part AI could do for you. This part is still yours.
Start by listing what you actually collect
Most founders cannot say, off the top of their head, exactly what fields their own database stores about a customer. Name and email are obvious; a signup IP address, a browser fingerprint, or an AI chat log tied to an account are the ones people forget, and each one is personal data the moment it can be linked back to a real person. You cannot protect, or honestly disclose, a list you have never actually written down, and a regulator's first question is almost always simply "what do you hold."
Tell your AI: "List every field in our database that could identify a real person, including ones I might not think of like IP addresses or support chat logs."
The right to be deleted has to actually work
If a customer asks you to delete their data, your database has to be able to do it cleanly, not just hide their account behind a flag while their information still sits in three other tables. This is the same gap covered in our post on privacy policies before launch: the document and the database have to agree with each other, or the promise you made in writing simply is not true. Test the deletion on a real test account before you ever need it for a real one.
Tell your AI: "Build a function that fully deletes one customer's data across every table when they request it, and show me the full list of tables it touches."
The fine is real, and it scales with you
Under GDPR's Article 83, the most serious violations carry fines of up to twenty million euros or four percent of a company's global annual revenue, whichever is higher. A one-person company is unlikely to draw the maximum, but the same law applies long before you have a legal team on hand to argue your case, so the habits are worth building from the first customer rather than retrofitting them once you have thousands.
Tell your AI: "Check our data collection and deletion process against GDPR's core requirements, and flag anything a regulator would consider a basic gap."