Data protection is easier before your product becomes messy
If your startup collects personal data, it is easier to think about consent, access, storage, and deletion before the product becomes complicated. Waiting until an institution asks can make compliance feel like an emergency.