[takinola]

Solve the problems you have not the problems you may have. If you are dealing with a specific industry or region, then your compliance needs should be obvious (EU - GDPR, Healthcare in US - HIPAA, etc). Of course, take all reasonable and appropriate precautions to secure and protect your customers' and users' data. As your business grows and evolves, you may find more compliance requirements but you probably don't need to deal with them until you hit those stages