The General Data Protection Regulation is the European Union's data protection law, and Article 3 gives it a reach wider than Europe - but the test is about establishments and about people in the Union, not passports. The regulation applies to processing done in the context of the activities of an establishment in the Union, regardless of whether the processing itself takes place there. It also applies to organizations with no EU establishment when they process personal data of data subjects who are in the Union, where the processing relates to offering them goods or services - paid or free - or to monitoring their behaviour, as far as that behaviour takes place in the Union. So a startup with no European office still falls inside when it targets people located there - and an EU citizen outside the Union is not covered on citizenship alone.
Seven principles run everything
Article 5 sets out seven principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability - the one that turns the rest into homework, since the controller must be able to demonstrate compliance. GDPR.eu's summary makes the point sharply: if you cannot show how you comply, you are not compliant.
You need a lawful basis, and consent is the demanding one
Processing is only lawful when it rests on one of the recognized bases, with consent and legitimate interest the two startups reach for most. Consent must be "freely given, specific, informed and unambiguous" - pre-ticked boxes and bundled terms do not qualify. Legitimate interest is more flexible, but the data subject's fundamental rights and freedoms always override your interests, especially with children's data. Whichever basis you choose, document it and tell the data subject; a later change needs its own basis and disclosure.
Users hold enforceable rights
People whose data you hold can exercise rights to be informed, to access, rectification, erasure, restriction, portability and objection. You need a working way to answer these, not just a privacy policy that mentions them.
Breaches and fines
When a personal-data breach occurs, Article 33 starts a short clock: the controller must notify the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it - unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Communication to the people affected is a separate duty under Article 34: it applies when the breach is likely to result in a high risk to their rights and freedoms, and it is not required when protection measures - the regulation names encryption - have rendered the lost data unintelligible to anyone not authorized to access it. Penalties come in two tiers, maxing out at 20 million euros or 4% of global annual revenue, whichever is higher - and individuals can separately claim damages.
What this means for you
Start smaller than a compliance program: write down what personal data you collect and why, document a lawful basis for each use, collect the minimum, publish a real contact for data requests, and know which supervisory authority you would notify of a breach - without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people's rights and freedoms at risk. The ICO publishes equivalent UK GDPR guidance for UK users.