Well, wait until you are at the receiving end. It can get nasty pretty quickly.

What does each one of your systems store exactly? Do they allow configuration of reasonable data retention policies for PII? What do your systems log? How do you make sure that only the minimum amount of PII (including user IP addresses) is logged and that the covered logs are destroyed at the end of a reasonable retention period?

How do you handle Data Subject Access Requests? Can you compile all the data related to that person in a reasonable time to send it to them?

How do you handle deletion requests? Can you name all the data storage that is affected if a deletion request comes in? Are your systems technically capable of deleting the data? What data is exempt (e.g. billing addresses can't just be deleted before the mandated archival period is over)? Do you maintain backups? Then how do you make sure that data covered by a deletion request is destroyed and stays gone even in the event of a backup recovery?

Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink.

> Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink

I doubt anybody wants to deal with fire safety inspections either.

Though I'm quite sure you will change your mind when your personal data gets hacked or your office burns down.

> Nobody who wants to bootstrap a business wants to deal with any of this. It's an enormous time sink.

Indeed but it forces you to answer these questions and to think about them during the development process as well, maybe even enough to write decent unit and regression tests for anything authentication/authorization related before some security "researcher" siccs Claude Code or whatever on your API and pwns it.