[jacobsenscott]

It seems easy because you don't need to prove it. You can do your best and then launch it.

But you can't prove it for under $15k and if you are successful eventually you'll need to prove it.

Anyway, I'm not talking about the GDPR. That's just bureaucrats testing the water. The US congress is starting to look for ways to get their cut as well.

It will get to the point where you need to prove compliance with multiple conflicting regulations first, before launching. Now you need to spend $100,000 on auditors before your first push to heroku.

Most people in software, especially startups, have never had any contact with a regulated industry and don't know what they are in for.