Tech startups and general data protection regulation: an empirical exploration of compliance challenges

The General Data Protection Regulation (GDPR), implemented in May 2018, has significantly affected businesses across the European Union (EU), placing strict legal requirements on how personal data is handled. For tech startups, which often deal with large volumes of personal data, GDPR compliance is especially crucial. Failure to comply can result in severe penalties, including substantial fines, reputational damage, and loss of customer trust (Teixeira et al., 2019; UpGuard, 2023). These risks along with complex regulatory environment can constrain innovation and impede growth (Zaguir et al., 2024).

As highlighted in previous studies (Martin, 2023; Zaguir et al., 2024), startups face unique challenges in GDPR compliance due to their limited resources. They must not only create a data protection-conscious culture but also train employees on GDPR protocols and implement reliable processes for managing personal data. The pressure to comply with these requirements is compounded by the need to balance market demands and internal resource constraints. As a result, for many startups, GDPR compliance becomes a costly and complex task (Li et al., 2022; Martin, 2023).

While research on GDPR compliance is growing, there are still significant gaps, particularly when it comes to startups. Many existing studies emphasize complexity of GDPR requirements and difficulties of implementation, but they often overlook the specific needs of early-stage companies (Negri-Ribalta et al., 2024). Furthermore, the literature lacks in-depth studies focused on small and medium-sized enterprises (SMEs), which form a large part of the EU economy (Li et al., 2020). Only few studies have focused on specific regions, such as Härting et al. (2020, 2021), who explored GDPR compliance challenges faced by German SMEs, highlighting issues like technical complexity, regulatory complexity, and compliance costs. Similarly, Freitas and Mira da Silva (2018) studied Portuguese industrial SMEs and identified challenges such as the need for staff training, technical infrastructure, and complex regulatory requirements.

Understanding how GDPR affects smaller organizations is crucial, as compliance challenges can vary significantly depending on the size and stage of the company (Smirnova and Travieso-Morales, 2024). Additionally, there is a shortage of country-, region-, and industry-specific research that could help understanding how to tailor GDPR support measures for startups. For instance, Catalonia, as Southern Europe’s leading startup hub with over 2,100 startups, is known for a unique environment for innovation (ACCIÓ, 2023). It has become a natural home for tech innovation, ranking as the fifth most digitized area in Europe, ahead of the UK, Germany, and Estonia (ACCIÓ, 2023). Yet, specific GDPR challenges faced by startups in this region remain underexplored.

This study aims to address these research gaps by exploring the GDPR compliance challenges faced by startups in Catalonia. To achieve this, the study applies the Technology-Organization-Environment (TOE) framework – a well-established theoretical model for understanding how organizations adopt and implement innovations. In this context, the framework views new regulations like GDPR as a form of innovation that startups must adopt to stay compliant. The TOE framework provides a clear and practical way for analysing how technological capabilities, organizational attributes, and external environmental factors influence GDPR compliance practices in startups.

This study makes several important contributions. First, it extends the theoretical application of the TOE framework by revealing that staff training plays a crucial mediating role between regulatory and technical complexities and compliance costs. In other words, staff training does not merely support compliance efforts but reduces the burden of these challenges, making it a key factor in regulatory adoption. Additionally, by applying the TOE framework to tech startups, this study demonstrates how firm characteristics, such as size, age, and sector, shape the way businesses perceive and respond to GDPR challenges. These findings enrich the TOE framework by showing that regulatory adoption is not just influenced by technological and environmental factors but also by how organizational capabilities, like staff training, help businesses manage regulatory and technical complexities.

Second, this study provides empirical evidence on how Catalonian tech startups perceive GDPR compliance challenges based on firm characteristics such as size, age, and sector. Our findings offer valuable practical recommendations for policymakers and the business sector, emphasizing the need for simplified regulatory guidance, accessible technical support, and tailored compliance training programs, especially for smaller, younger and non-tech startups.

Third, our methodological contribution lies in leveraging survey data and interviews from Catalonian tech startups to present fresh insights on GDPR compliance challenges. By obtaining firsthand perspectives from startups of various sizes, ages, and sectors, our study offers a new approach to understanding how these firms address various GDPR compliance challenges. Additionally, our scrutinized methodological approach ensures replicability of this study in future research on GDPR challenges in different contexts.

The implementation of the GDPR poses several key challenges for companies, which can be categorized into technical, legal and regulatory, and organizational issues (Smirnova and Travieso-Morales, 2024). SMEs and startups are particularly sensitive to these challenges due to their limited human and financial resources (Freitas and Mira da Silva, 2018; Kaluge, 2023; Martin, 2023; Teixeira et al., 2019; Tikkinen-Piri et al., 2018). For example, many startups struggle to allocate enough funds to hire dedicated compliance personnel, leading to inadequate understanding of GDPR obligations (Mladinić et al., 2023).

The legal language of the GDPR can also be vague and imprecise, complicating compliance efforts for startups that lack in-house legal expertise (Negri-Ribalta et al., 2024; Saniei, 2021; Smirnova and Travieso-Morales, 2024). Additionally, privacy policies remain difficult to comprehend, which can result in non-compliance due to a lack of clarity about user rights and company data practices (Zhang et al., 2023). Furthermore, many companies encounter challenges in implementing processes accurately due to ambiguous interpretations of the GDPR regulations (Härting et al., 2020; Marotta and Madnick, 2021; Politou et al., 2018).

On the technical side, complexities arise in the context of linked data and data aggregation, where personal data must be combined with other sources (Kutyłowski et al., 2020). To address these challenges, startups must adapt their IT systems to comply with GDPR requirements, which frequently involves integrating advanced technologies like blockchain to ensure data integrity and transparency (de Carvalho et al., 2020; Politou et al., 2018; Zhou et al., 2023). This creates a vicious cycle, as the need for such specialized solutions requires both technical and legal expertise, forcing startups to either hire new staff or contract professionals, thereby further increasing their operational costs.

Over the past decade, both Spain’s and Catalonia’s tech ecosystems have undergone a remarkable transformation. Between 2019 and 2024, the Spanish startup ecosystem grew nearly threefold (2.7 times), making it one of the fastest growing in Europe, just behind Norway (ThinkTur, 2024). At the forefront of this growth is Barcelona, Spain’s leading city for startups, with Madrid following closely behind (Statista, 2024).

Catalonia has firmly established itself as Southern Europe’s largest startup ecosystem and the fifth-largest startup hub in the EU. With over 2,100 startups in Catalonia (Figure 1), 86.7% of which are based in the Barcelona metropolitan area, Barcelona is recognized as the world’s leading non-capital tech city (ACCIÓ, 2024). This thriving ecosystem has received prestigious accolades, including recognition by the Financial Times as Europe’s second-best city for a thriving tech ecosystem, second only to Berlin, and a ranking by the Boston Consulting Group as the world’s fifth most attractive city for digital talent (ACCIÓ, 2023).

Catalonia’s tech-driven economy has fuelled the growth of startups specializing in advanced Industry 4.0 technologies, with 71% operating in fields such as artificial intelligence (AI), big data, automation, cloud computing, immersive technologies, robotics, blockchain, cybersecurity, quantum and photonic sciences, and digital twin simulation. AI and big data stand out as core technologies for 31% of these startups (ACCIÓ, 2024), which underscores the crucial role of data privacy and security due to the vast amounts of data handled. However, these industries face significant challenges, including intense competition, rapid technological changes, and limited resources, which exacerbate GDPR compliance challenges. Additionally, many regional funding programs tie grant eligibility to GDPR adherence, adding financial strain and regulatory pressure on emerging companies.

Catalonian startups must deal with both local and national regulatory frameworks, including those from regional data protection authorities and the varying interpretations of GDPR. While GDPR enforcement in Spain is centralized under the Spanish Data Protection Agency (AEPD), Catalonia has its own Catalan Data Protection Authority (APDCAT), which oversees data protection for entities under the jurisdiction of the Catalan government, creating an additional layer of oversight. Local authorities typically face challenges in understanding and applying GDPR, with the added complexity of local political dynamics (Marcut, 2019). Despite the Catalan’s government emphasis on privacy and data protection, there still remains a lack of clarity regarding how these regional regulations align with the EU-wide GDPR standards.

Many Catalonian startups face a trade-off between innovation and the need to implement strong data protection measures. The focus on rapid market entry and development, typical of the startup culture, may lead to a negligence for GDPR compliance in the early stages, which might have serious long-term consequences (Norval et al., 2021). This conflict between innovation and compliance is especially common in sectors like AI and blockchain, where technological complexities and data volume make GDPR compliance particularly difficult (Mone and Sivakumar, 2022).

The Catalonian context thus presents a unique combination of regulatory, organizational, and technological challenges that require more specific attention in GDPR compliance research. Previous studies have often generalized the challenges faced by startups without addressing how regional factors, such as local regulatory interpretations, the level of technological maturity, and sector-specific demands, may influence compliance efforts. This study aims to fill this gap by examining how these factors shape the way startups approach GDPR compliance in Catalonian context, using the TOE framework as a perspective.

The Technology-Organization-Environment (TOE) framework, developed by Tornatzky and Fleischer (1990), is a widely used tool for analysing how internal and external factors influence the adoption of innovations or regulations within organizations. It is especially useful for examining the challenges startups face in achieving GDPR compliance, as it integrates technological, organizational, and environmental dimensions that shape compliance decisions (see Zian et al., 2024). Prior studies, such as Ramdani et al. (2013), which analysed SMEs' adoption of enterprise applications using the TOE framework, have demonstrated its effectiveness in understanding the interconnections between these dimensions. The framework’s applicability is particularly relevant for GDPR compliance, where internal challenges intersect with external pressures, creating a complex environment for startups to manage and adapt to.

The technological dimension of the TOE framework can be examined through the lens of technologies and technological infrastructure that influence an organization’s ability to meet GDPR requirements. Technical complexity is central here, as startups often need to implement robust systems for data encryption, secure storage, and access control (Karippur et al., 2024). These technical demands often require substantial system overhauls or upgrades, creating challenges for startups with limited resources and expertise. Moreover, vague technical guidelines in GDPR regulations exacerbate the difficulty of ensuring compliance, requiring organizations to invest heavily in IT solutions tailored to their specific needs (Mladinić et al., 2023; Zhou et al., 2023).

The organizational dimension encompasses internal factors such as company size, structure, resources, and workforce capabilities, which substantially affect compliance efforts. Staff training is particularly critical in this context, as ensuring compliance requires all employees, from leadership to technical staff, to understand their roles and responsibilities (Li et al., 2022; Guamán et al., 2023). Startups often face resource constraints, making it difficult to allocate personnel or budgets for comprehensive training programs. Additionally, smaller or younger startups, especially those with weak internal processes, limited resources (Martin, 2023) or insufficient managerial support, may struggle to establish a culture of compliance (Badghish and Soomro, 2024). Therefore, investing in staff training can mitigate the challenges associated with technical and regulatory complexities, raising organizational readiness for GDPR compliance (Busse and Doganer, 2018) and reducing compliance costs (Martin, 2023).

Finally, the environmental dimension of the TOE framework considers external pressures, such as regulatory requirements, market conditions, and competitive forces, which influence how startups approach GDPR compliance. The regulatory complexity can be seen as a key challenge within this dimension. GDPR’s complexity and legal ambiguities often force startups to seek external expertise, such as legal consultants or specialized compliance services (Karippur et al., 2024). While these collaborations help address the complexity of the regulation, they also contribute to compliance costs, further straining startups with limited financial resources. Additionally, startups must meet market expectations and industry standards, which can add even more external pressure to achieve compliance (Wang et al., 2022).

The challenges of GDPR compliance are interconnected across the dimensions of the TOE framework. For instance, regulatory complexity (environmental dimension) can significantly influence both technical complexity (technological dimension) and staff training (organizational dimension). As Freitas and Mira da Silva (2018) observe, complex regulatory requirements create a need for more advanced technical solutions and require significant investment in employee training to manage compliance effectively. Similarly, Härting et al. (2020) add that regulatory complexity and ambiguity often drive startups to invest in IT systems that can adapt to evolving legal demands, thus increasing compliance costs and operational risks.

Staff training, as part of the organizational dimension, plays a crucial role in addressing the interconnected challenges of technical complexity (technological dimension) and regulatory complexity (environmental dimension). Organizations that prioritize continuous training and create a culture of knowledge-sharing are better prepared to handle the complexities of GDPR compliance. Sirur et al. (2018) highlight that such investments not only improve operational efficiency but also help reduce the costs associated with compliance efforts. Furthermore, Guamán et al. (2023) and Härting et al. (2020) emphasize that the effectiveness of staff training depends heavily on the clarity of regulatory requirements and the complexity of technical systems, i.e. greater challenges in staff training arise from ambiguous legal frameworks and more complex technological infrastructures.

Technical complexity (technological dimension) is often intensified by regulatory complexity (environmental dimension). As regulations evolve, startups must continuously adapt their IT systems and infrastructure to meet new requirements, resulting in heightened technical demands (Karippur et al., 2024). Norval et al. (2021) further underscore that the technical burden of GDPR compliance forces startups to adopt innovative data security measures, which require advanced technologies and additional investments.

These interdependencies among the three dimensions of the TOE framework are further reinforced by Freitas and Mira da Silva (2018), Härting et al. (2020), and Smirnova and Travieso-Morales (2024), who highlight the combined influence of regulatory, technological, and organizational factors on the overall GDPR compliance costs (organizational dimension). Thus, the following hypotheses are proposed for further investigation:

Investing more in staff training can help mitigate the challenges posed by technical and regulatory complexities. In this regard, Karippur et al. (2024) argue that well-prepared employees are better equipped to address these complexities, resulting in improved effectiveness and reduced compliance costs. This perspective is supported by Sirur et al. (2018), who emphasize the importance of fostering organizational learning to adapt to compliance challenges. This leads to the second hypothesis:

This interplay between regulatory complexity, technical complexity, staff training, and compliance costs within the TOE framework highlights the intricate relationships that shape GDPR compliance challenges. These dimensions are not isolated but rather interdependent, with each contributing to the complexity of compliance for startups. The hypotheses presented in this section (see Figure 2) aim to further explore these relationships, providing a deeper understanding of how organizational, technological, and environmental factors intersect. As we transition to the next section, the focus shifts to examining how these compliance challenges may vary based on the age, size, and sector of the company.

The ability of startups to comply with GDPR requirements is substantially influenced by their age, size, and sector. Younger startups often lack well-established data protection practices, which increases their risk of non-compliance (Guamán et al., 2023; Martin, 2023). Many of these startups also have limited awareness of the complexities of GDPR, leading to misconceptions about their legal obligations (Martin, 2023; Norval et al., 2021). This lack of awareness, combined with limited resources, makes it particularly challenging for startups to implement the necessary technical and organizational safeguards (Georgiopoulou et al., 2020). Additionally, the pressure to prioritize rapid product development and market entry often dominates the need for implementing robust data protection measures, further adding to the risk of non-compliance (Norval et al., 2021).

In contrast, more established startups, while having more experience and better-developed processes (Balachandran, 2024), may still encounter certain challenges in adapting to GDPR standards (Norval et al., 2021). These companies are often burdened with legacy systems that were not originally designed with data protection in mind, making it difficult to align existing systems and processes with the latest GDPR requirements (Norval et al., 2021). Adapting to GDPR may require extensive system overhauls, including thorough audits and data reclassification efforts, to reconcile outdated practices with current regulations. The rigidity of these legacy systems can impede the implementation of necessary changes, such as data anonymization and secure data handling mechanisms, which are essential for GDPR compliance (Cohen and Nissim, 2020). This suggests that the age of a startup plays a crucial role in shaping perceptions of compliance challenges, with younger startups viewing these complexities differently as compared to older, more established counterparts. This disparity may also affect their capacity to manage GDPR compliance, aligning with the organizational dimension of the TOE framework.

As various studies demonstrate, the size of a startup may also affect its capacity to meet GDPR requirements. Smaller companies, often constrained by limited financial and human resources, may struggle to allocate sufficient funds for compliance-related investments (Härting et al., 2020; Magdziarczyk and Widera, 2024; Poritskiy et al., 2019; Sirur et al., 2018), such as upgrading or acquiring new technology, obtaining legal advice, and employing specialized personnel. With reduced capability to hire dedicated compliance officers, small startups often rely on existing staff to manage GDPR compliance, which can dilute their focus from the main business activity and decrease effectiveness (Busse and Doganer, 2018).

In contrast, larger startups typically have more resources which enables them to hire dedicated compliance personnel or invest in advanced data protection technologies (Martin, 2023). However, as the size of the startup grows, so does the complexity of its operations. Larger organizations often struggle to implement uniform GDPR compliance measures across multiple departments with distinct data handling practices, which complicates overall compliance efforts (Magdziarczyk and Widera, 2024). Thus, the size of a startup, as an internal characteristic, plays an important role in its ability to meet GDPR requirements, aligning thereby with the organizational dimension of the TOE framework.

Lastly, previous research shows that different sectors within the technology industry face unique challenges in achieving GDPR compliance. For instance, software development startups must design their products with privacy-by-default principles, which often means significant changes to their traditional software development processes (Saltarella et al., 2024). Startups in sectors such as AI, cloud computing, and IoT face even greater complexities, as the vast amount of data they process makes it harder to apply GDPR guidelines, requiring tailored strategies (Mone and Sivakumar, 2022). The media sector has also faced considerable challenges, with notable GDPR violations reflecting persistent issues with compliance and an urgent need for better data management practices (Colmenero-Fernandez, 2023). Furthermore, a study by Guamán et al. (2023) revealed that nearly 50% of Android apps might not comply with GDPR, indicating a substantial gap between regulatory requirements and actual practices. These sector-specific challenges are further shaped by the environmental dimension of the TOE framework, as each sector must adapt to GDPR based on its unique data handling practices and regulatory requirements.

Given the discussed variations, it is crucial to understand how factors such as age, size, and sector influence startups' perceptions of GDPR compliance challenges. To explore these influences further, the following hypotheses have been formulated:

The following section explains the methodology used to test these hypotheses, including the research design, data collection methods, and analysis techniques that help us explore how these variables impact GDPR compliance in different types of startups.

This study employs a mixed-methods approach, combining a survey to collect quantitative data on the perceptions of Catalonian tech startups regarding GDPR compliance challenges, and interviews with top management from three Catalonian startups to gain qualitative insights for triangulation. The survey method was chosen for its effectiveness in collecting large amounts of data from a broad population (Babbie, 2013, p. 250). Data collection took place between May and December 2021 through a self-administered, internet-mediated questionnaire ( Annex 1), distributed to Catalonian tech startups. The target audience included managers, directors, board members, founding employees, Data Protection Officers (DPOs), Chief Privacy Officers (CPOs), and Chief Technology Officers (CTOs) responsible for GDPR compliance.

The sample size was determined following the recommendations of Sue and Ritter (2012). Using a 95% confidence level, a 5% margin of error, a population proportion of 50%, and a population size of 1,703 startups (the number of startups operational in 2020 according to ACCIÓ (2021)), it was calculated that responses from at least 314 startups were needed to obtain a representative sample. A simple random sampling technique was applied to select study participants from the population, ensuring that each respondent had an equal chance of being chosen to participate in the survey.

To avoid low response rate, the initial sample size was doubled (Beehr et al., 2022) to 628, and multiple contact methods, such as email and telephone calls, were considered (Guinalíu and Díaz de Rada, 2021; Millar and Dillman, 2011). However, despite these precautions, the initial response rate remained very low. Consequently, it was decided to contact all 1,703 technology startups (the entire population) in an effort to achieve the minimum sample size required to be representative of the whole population.

The selected sampling strategy and data collection efforts resulted in 116 returned questionnaires, corresponding to a survey response rate of approximately 37% of the initially planned sample size. The data was cleaned for outliers, and a missing data analysis was conducted using the Expectation-Maximization method. To avoid bias or reduced variability from imputation, “Not applicable” responses were treated as system-missing data (Holman et al., 2004). An analysis of the missing data pattern indicated that the data were missing completely at random (MCAR), as evidenced by a p-value of 0.478. Although the missing data did not significantly deviate from what would be expected under the MCAR assumption, we opted to exclude the 9 responses with missing data to avoid any potential risks associated with imputation. This decision was made to preserve the reliability of the dataset, ensuring that the sample consisted solely of complete responses. Consequently, 107 valid responses were retained, minimizing potential distortions that could arise from imputation or incomplete data and thereby ensuring the robustness and validity of the results. The demographic data of survey participants is summarized in  Annex 1.

Given the lack of research focusing on specific challenges Catalonian startups face with GDPR compliance, we decided to conduct in-depth interviews with key figures from local technological startups. The interview data was collected from top management representatives of three startups operating in distinct sectors: e-commerce, biotech, and smart logistics. Each interview lasted approximately 45–60 min and was conducted in person or via video conferencing, depending on the availability and preference of the interviewees. All interviews were audio-recorded, with the participants' consent, to ensure accurate transcription and analysis.

The interviewees from each startup were asked the following four open-ended questions:

1. Have you faced any challenges related to GDPR compliance costs?

2. Have there been any challenges for the company regarding the complexity of the GDPR?

3. How has government support impacted your GDPR compliance efforts? Was there any?

4. Have you faced any challenges when adapting your company’s processes to comply with GDPR?

The data obtained from the interviews was used for triangulation purposes to cross-check and validate the findings from quantitative data assessment and ensure a more comprehensive and reliable examination of the research topic.

The perceptions of Catalonian startups regarding the challenges associated with GDPR implementation, such as compliance costs, staff training, regulatory complexity, and technical complexity, were measured using a scale developed by the authors based on previous studies by Freitas and Mira da Silva (2018), Härting et al. (2020, 2021), Norval et al. (2021), Politou et al. (2018), Poritskiy et al. (2019), and Tikkinen-Piri et al. (2018). A five-point Likert scale, ranging from “1 - strongly disagree” to “5 - strongly agree”, was utilized as a measurement instrument. Respondents also had the options to answer “Not applicable” and “I don’t know.” For the purposes of the study, the “I don’t know” responses were treated as “3 - somewhat agree/somewhat disagree,” in line with Denman et al. (2018), who consider “I don’t know” as a neutral midpoint in a Likert response scale.

After conducting normality tests with satisfactory results, Exploratory Factor Analysis (EFA) was performed to verify the conceptualization of the constructs. The analysis included 15 survey questions (items) and 107 respondents (cases), resulting in a ratio of 7.1 cases per item, which adheres to the recommended range of five to ten participants per item for robust results (Faulkner, 2003). While a general rule suggests a sample size of at least 200 cases for reliable and replicable factor structures, Winter et al. (2009) demonstrated good-quality results with smaller samples.

The Principal Component Analysis (PCA) with Varimax Kaiser rotation identified four factors explaining 71% of the variance, with acceptable factor loadings ranging from 0.679 to 0.908 (Field, 2013, p. 692), except for one item in the compliance costs construct and one item in technical complexity construct, which were removed. The final scale consisted of 13 question items (see  Annex 2) with good factor loadings, higher reliability of the constructs and better model fit. A Kaiser-Meyer-Olkin (KMO) Measure of Sampling Adequacy yielded a value of 0.730, and Bartlett’s test showed significant correlations in the data at the 0.05 level, justifying the appropriateness of factor analysis (Bartlett, 1954; Kaiser, 1974). The EFA results of this study should be considered preliminary and should be verified with confirmatory factor analysis using a larger sample (Byrne, 2016).

The instrument scales and their reliability are shown in Table 1. The measure of internal consistency, Cronbach’s alpha, ranges between 0.688 and 0.886, indicating an acceptable reliability level. According to Hair et al. (2010) and Ramayah et al. (2014), Cronbach’s alpha values exceeding 0.60 for all constructs in the model are considered acceptable, affirming the instrument’s satisfactory reliability.

Survey data was analysed using SPSS v.23. First, descriptive statistics (frequencies, means, and standard deviations) were calculated to understand the data distribution and identify any anomalies (Field, 2013). Next, Spearman’s correlation analysis was conducted to explore relationships and check for multicollinearity. Spearman’s correlation was chosen because some of the variables were categorical, which ensured that the regression analyses later on are not affected by redundant predictors (Corder and Foreman, 2014).

Multiple regression and hierarchical regression analyses were then performed to further investigate the relationships among variables (Field, 2013). Multiple regression was used to examine predictive relationships between regulatory complexity, technical complexity, staff training, and compliance costs, while controlling for startup age, size and business sector. This technique was deemed appropriate as it allowed us to determine the relative influence of each predictor on dependent variables and to assess the overall explanatory power of our models (Hair et al., 2010).

Additionally, hierarchical regression was employed to evaluate the incremental value of staff training in predicting GDPR compliance costs. In line with the research purpose and Hypothesis 2, hierarchical regression was especially useful because it allowed us to add predictors in a sequential manner and examine how much additional variance was explained by staff training beyond that accounted for by regulatory and technical complexities. Changes in R² and F statistics were analysed across the steps to refine the model and assess the unique contributions of each variable, as suggested by Cohen et al. (2013).

Based on the study’s objectives and hypotheses, three multiple linear regression models (addressing Hypotheses 1a, 1b, and 1c) and one hierarchical regression model (addressing Hypothesis 2) were specified. The first model, for instance, was designed to predict GDPR compliance costs (the dependent variable) using staff training, regulatory complexity, and technical complexity as independent variables, along with control variables for startup age, size, and business sector. Model 1 was specified as follows:

where,

• $Y$ is a dependent variable representing compliance costs.

• $X1,X2,X3$ are continuous predictors (staff training, regulatory complexity, and technical complexity).

• $Zi,Wj,Sl$ are categorical variables for age, size, and sector, converted into dummy variables.

• $β0$ is the intercept that represents baseline compliance costs.

• $β1,β2,β3,βi,βj,βl$ are the regression coefficients of independent and dummy variables that reflect the effect of their respective variables on compliance costs.

• $ϵ$ is an error term capturing unexplained variation.

Similarly, Model 2 was structured to predict staff training (the dependent variable, $Y$⁠) based on regulatory complexity (⁠$X1$⁠) and technical complexity (⁠$X2$⁠), while maintaining control for startup age, size, and sector. Model 3 was developed to examine the impact of regulatory complexity (independent variable, $X$⁠) on technical complexity (dependent variable, $Y$⁠), with the same control variables applied.

To explore the mediation effect of staff training on GDPR compliance costs, Model 4 was developed using hierarchical regression analysis in accordance with Baron and Kenny’s (1986) framework. In this approach, three steps were involved:

• Step 1: Firm characteristics, including startup size, age, and sector were introduced as predictors of GDPR compliance costs.

• Step 2: Regulatory complexity (⁠$X1$⁠) and technical complexity (⁠$X2$⁠) were incorporated to assess their impact on compliance costs (⁠$Y$⁠), while controlling for startup age, size, and sector.

• Step 3: Staff training (⁠$X3$⁠) was added as a mediator to examine its additional contribution to explaining compliance costs.

Lastly, a One-Way Analysis of Variance (ANOVA) was performed to determine whether significant differences existed in the mean values of the four constructs (Field, 2013). Additionally, ANOVA was used to assess whether GDPR implementation challenges varied significantly based on factors such as startup age, size, and business sector. For significant results, effect sizes were measured using partial eta squared (ƞ²) for ANOVA (Cohen, 1988, as cited in Lakens, 2013).

The first step in the data analysis involved examining descriptive statistics and assessing the relationships between GDPR compliance costs, staff training, regulatory complexity, technical complexity, and control variables: startup age, size, and sector (Table 2). The obtained mean values suggest that the respondents perceive technical complexity as the most significant challenge (M = 3.80), followed by regulatory complexity, compliance costs, and finally, staff training with the lowest mean (M = 2.80). The standard deviations indicate that there is a relatively consistent agreement among the respondents on technical complexity (SD = 0.84) and compliance costs (SD = 0.88). In contrast, there is more variation in opinions regarding staff training, possibly indicating differences in how organizations prioritize or experience this factor (SD = 1.08). For the categorical variables (startup age, size, and sector) mean values and standard deviations were not calculated as these measures are only meaningful for continuous data.

The results of the Spearman’s rank-order correlation analysis show that GDPR compliance costs are moderately correlated with staff training (ρ = 0.371, p < 0.01) and weakly correlated with regulatory complexity (ρ = 0.217, p < 0.05). Furthermore, staff training is moderately correlated with regulatory complexity (ρ = 0.361, p < 0.01) and technical complexity (ρ = 0.343, p < 0.01). Regulatory complexity also demonstrates a moderate positive correlation with technical complexity (ρ = 0.307, p < 0.01) and a weak negative correlation with startup age (ρ = -0.263, p < 0.01). These results may indicate that as the perceptions of regulatory and technical complexities increase, startups are likely to invest more in staff training, which in turn is associated with higher compliance costs. The negative correlation between regulatory complexity and startup age may imply that younger enterprises face greater challenges in understanding GDPR requirements. Startup size, however, did not show any correlation with the other variables.

A repeated-measures ANOVA was conducted to test for significant differences among the mean values of compliance costs, staff training, regulatory complexity, and technical complexity. Multivariate tests showed a strong effect of the “Challenges” factor, Wilks' Lambda = 0.527, F (3,110) = 32.882, p < 0.001, indicating that at least one challenge type significantly differed from the others. Mauchly’s test confirmed that the assumption of sphericity was met (p = 0.789). The within-subjects analysis further demonstrated a highly significant main effect of challenges, F (3,336) = 35.664, p < 0.001), pinpointing to substantial variations in perceived difficulty among the challenges.

A pairwise comparison with Bonferroni correction was conducted to identify significant differences among GDPR compliance challenges while controlling for Type I error (Field, 2013). A heatmap of the pairwise mean differences, based on Bonferroni-adjusted comparisons, is presented in Figure 3. Warmer tones indicate higher positive differences, while cooler tones represent negative differences. Significant differences were mainly between staff training and the other challenges. These findings indicate that although compliance costs, regulatory complexity, and technical complexity represent significant challenges for startups, staff training is not considered a key issue in GDPR compliance.

The analysis revealed that staff training (M = 2.80, SD = 1.08) was rated significantly lower than compliance costs (MD = 0.744, SE = 0.099, p < 0.001), regulatory complexity (MD = 0.835, SE = 0.102, p < 0.001), and technical complexity (MD = 0.914, SE = 0.102, p < 0.001). Cohen’s d effect sizes further highlight the magnitude of these differences, with compliance costs versus training costs showing a medium-to-large effect (d = 0.73), and regulatory complexity (d = 0.79) and technical complexity (d = 0.87) demonstrating large effects. However, no significant differences were found between compliance costs, regulatory complexity, and technical complexity (p > 0.05), suggesting these challenges are perceived at similar levels.

The next step involved examining predictive relationships between the variables (compliance costs, staff training, regulatory complexity, and training complexity) by evaluating several multiple linear regression models (see Table 3). Startup size, age and sector were included as control variables using dummy coding. The reference variables were selected based on their frequencies and multicollinearity considerations, and included startup size (“2 to 9 employees”), startup age (“1 year or less”), and the “ICT” sector.

Model 1: Predicting GDPR Compliance Costs. Model 1 aimed to explore whether staff training, regulatory complexity, and technical complexity predicted GDPR compliance costs. The overall model was statistically significant, F (16, 89) = 3.091, p < 0.001, explaining 35.7% of the variance in GDPR compliance costs (R² = 0.357). The model did not show signs of multicollinearity as all Variance Inflation Factor (VIF) values were below the threshold of 10.

The regression analysis showed that staff training had a significant positive effect on GDPR compliance costs (β = 0.448, p < 0.001), indicating that higher investments in training are associated with increased compliance expenditures. But neither regulatory complexity nor technical complexity were significant predictors of GDPR compliance costs. Startup size played a crucial role, with larger startups (10–49 employees) experiencing lower compliance costs (β = −0.368, p < 0.05) compared to the reference group, while startups with 0–1 employee showed no significant difference. Sector-wise, startups in business services (β = 0.273, p < 0.05) and leisure (β = 0.330, p < 0.01) experienced significantly higher challenges in compliance costs than in the ICT sector. However, startup age was not a significant factor in predicting compliance costs.

Model 2: Predicting Staff Training Challenges. The regression analysis revealed that both regulatory complexity (β₁ = 0.235, p < 0.05) and technical complexity (β₂ = 0.266, p < 0.05) significantly predicted staff training challenges, accounting for 35% of the variance (R² = 0.349, F (15, 90) = 3.224, p < 0.001), with no multicollinearity issues. Additionally, startup size had a substantial impact, with the smallest startups (0–1 employee) reporting higher staff training challenges (β = 0.298, p < 0.05), while larger startups (10–49 employees) faced even greater challenges (β = 0.359, p < 0.05). However, no statistically significant differences were found for startup age or sector.

Model 3: Predicting Technical Complexity. A multiple linear regression analysis was run to determine whether regulatory complexity, while controlling for startup size, age, and sector, could predict technical complexity challenges. The overall model was statistically significant (F (14, 91) = 2.785, p < 0.01) and explained 30% of the variance in technical complexity (R² = 0.300). Collinearity diagnostics indicated no multicollinearity issues.

The results for Model 3 showed that regulatory complexity was a significant predictor of technical complexity, demonstrating a strong positive relationship (β₁ = 0.331, p < 0.001). This suggests that startups perceiving regulations as more complex also tend to experience greater technical challenges in compliance. Startup size also influences perceptions of technical complexity, with larger startups (10–49 employees) reporting lower levels of technical complexity (β = −0.249), likely due to better access to specialized compliance resources and legal expertise. In contrast, the smallest startups (0–1 employee) did not show a significant difference compared to the reference category. Regarding startup age, older startups (6–7 years: β = 0.243, p < 0.05; 10+ years: β = 0.262, p < 0.05) were more likely to perceive higher technical complexity, possibly reflecting difficulties in resource organization and managing technical requirements despite greater organizational maturity. No significant effects were found for sector-related variables.

Based on the findings from the multiple regression analyses, H1a can be partially accepted, as only staff training significantly predicted compliance costs, while regulatory complexity and technical complexity did not. H1b is fully accepted, as both regulatory complexity and technical complexity significantly influenced staff training challenges. Lastly, H1c is also accepted, as regulatory complexity was found to significantly predict technical complexity in GDPR compliance.

Model 4: Hierarchical Regression. A hierarchical regression analysis was conducted to examine the factors influencing startups’ compliance costs and to assess the mediating role of staff training challenges in this relationship. Three sequential models were tested to determine how firm characteristics, regulatory and technical complexities, as well as staff training challenges contribute to compliance costs (Table 4).

Step 1 included firm characteristics such as startup size, age, and sector, as predictors of GDPR compliance costs. These factors accounted for 22.6% of the variance (R² = 0.226) in compliance costs, but the model was not statistically significant (p = 0.276), indicating that firm characteristics alone do not explain variations in compliance costs.

In Step 2, additional predictors, regulatory complexity and technical complexity, were introduced. Although these factors were expected to have a stronger influence, the model’s explanatory power increased only slightly (R² = 0.274, ΔR² = 0.093, F for ΔR² = 12.063), and the overall model remained statistically non-significant (p = 0.198). This suggests that while both regulatory and technical complexities may contribute to compliance costs, their direct effect remains limited.

Step 3 incorporated staff training as an additional predictor, which significantly improved the model’s explanatory power, with the R² increasing to 0.356 (ΔR² = 0.131, F for ΔR² = 18.111, p < 0.001). This suggests that staff training partially mediates the relationship between regulatory and technical complexities and GDPR compliance costs. In other words, rather than directly increasing compliance costs, regulatory complexity and technical complexity create a need for staff training, which in turn raises overall expenses related to GDPR compliance. This underscores the importance of addressing staff training as a key intervention area to mitigate compliance costs.

The results of one-way ANOVA tests, presented in Table 5, along with the Post Hoc tests for multiple comparisons using Tukey’s HSD, reveal statistically significant differences in perceptions of regulatory complexity based on the age of the startup. Specifically, more recently established enterprises (2–3 years ago) display significantly higher perceptions of regulatory complexity compared to those established 4–5 years ago or 8–9 years ago, with a mean difference of 0.82 (p = 0.017) and 1.03240 (p = 0.003), respectively. A large effect size, as measured by Eta squared (η² = 0.20), indicates that 20% of the variance in the perceptions of regulatory complexity is attributable to the age of the startup.

The outcome of one-way ANOVA, as reported in Table 6, indicates that startup size does have an impact on perceptions of technical complexity (p = 0.048). However, this effect is not substantial, as subsequent Post Hoc tests using Tukey’s HSD method did not reveal any significant differences in the means among various startup sizes. This trivial effect may be due to a relatively small effect size (η² = 0.057), suggesting that the practical mean differences between the individual groups are too minor to be detected by the Post Hoc tests. This could be resolved by increasing sample size and repeating tests.

A repeated measures ANOVA, presented in Table 7, showed significant differences in perceptions of compliance costs across different startup business sectors (F = 2.297, p = 0.018). Subsequent Post Hoc comparisons revealed that startups in the leisure sector perceive GDPR compliance costs (M = 4.08, SD = 0.64) to be significantly higher compared to those in the ICT sector (M = 3.29, SD = 0.72), with the mean difference of 0.79 (p = 0.018). A moderately large effect size, as measured by Eta squared (η² = 0.13), suggests that the business sector of a startup has a considerable impact on how costly the GDPR compliance is perceived to be.

The findings indicate that among the GDPR compliance challenges analysed, staff training is perceived significantly less challenging by startups than compliance costs, regulatory complexity, and technical complexity. However, no significant differences were found among the latter three variables, suggesting that startups view them as similarly challenging. The importance of these challenges aligns with the results obtained by Conley and Pocs (2018), Maunula (2020), Ryan et al. (2020), Sirur et al. (2018), and Zaguir et al. (2024). This is also consistent with some previous research that highlights varied perceptions on the importance of staff training for GDPR compliance (Nayak et al., 2024; Zaguir et al., 2024). This suggests that startups might have diverse needs when it comes to GDPR compliance training.

The findings from the correlation analysis provided deeper understanding of the relationships between GDPR compliance challenges. Notably, despite its relatively low rating by survey respondents, staff training emerges as a central factor influencing GDPR compliance. A moderate positive correlation between GDPR compliance costs and staff training suggests that startups investing in compliance are also likely to allocate substantial resources to training their staff. The results of the correlation analysis also reinforce the idea that as GDPR’s technical and regulatory demands grow, the need for specialized staff training increases, underlining the interconnected nature of GDPR compliance challenges, as also mentioned by Zaguir et al. (2024).

Previous research emphasized that GDPR compliance requires substantial financial and human resources, including adequate employee training (Freitas and Mira da Silva, 2018; Kaluge, 2023; Martin, 2023; Teixeira et al., 2019; Tikkinen-Piri et al., 2018). However, the link between compliance costs, staff training, and regulatory and technical complexities remains largely unexplored. Our findings address this gap, showing that regulatory and technical complexities indirectly drive compliance costs by increasing the need for staff training, which emerges as the primary cost factor in GDPR compliance.

To begin with, our analysis revealed a positive relationship between regulatory complexity and technical complexity. Startups that perceive GDPR requirements as more complex are likely to struggle with technical implementation of compliance measures. Interviewees underscored this connection, with Startup 1 stating, “We needed to define internal processes for finding and delivering data within the required timeframe. While it worked well, it was not easy.” Startup 2 added, “It was challenging to adapt the business model and know where all personal data was stored, especially with emergent technologies.” Startups agreed that periodic audits, responding to data inquiries, and ensuring data portability are particularly demanding tasks. These findings are consistent with previous studies (Härting et al., 2021; Poritskiy et al., 2019), who highlight that regulatory complexity often leads to substantial process adaptation challenges, particularly for micro and small enterprises.

Our findings further indicate that both regulatory and technical complexities significantly increase the need for staff training in startups. This is particularly relevant in the context of the Catalonian startup ecosystem, which is driven by advanced and complex technologies. To ensure GDPR compliance, companies must provide specialized training to help employees adapt procedures in line with regulatory requirements. Implementing GDPR-compliant systems requires continuous adaptation to evolving security and data management standards, further reinforcing the importance of staff training. This aligns with findings from Guamán et al. (2023) and Härting et al. (2020), who emphasized that the effectiveness of training depends on the complexity of technical systems and the clarity of regulatory guidelines. Additionally, companies perceiving higher regulatory complexity are more likely to invest in staff training, as supported by previous research by Lundgren (2020) and insights gathered from interviews.

For instance, Startup 1 underlined the challenge of understanding legal terminology, stating, “GDPR is complex and difficult to understand. Even as a technologist, I found legal terminology challenging, so we created plain-language documents to help employees.” Similarly, Startup 2 shared, “We had difficulties understanding and interpreting GDPR. Changing the company mindset to ensure employees follow GDPR principles was challenging.” Startup 3 echoed these concerns, expressing frustration with the lack of clarity, saying, “GDPR is complex and lacks precision, making it hard to interpret for startups.”

Building on these challenges, startups that acknowledge GDPR’s complexity often respond by prioritizing staff training or hiring dedicated compliance personnel, both of which contribute to higher compliance costs. For example, the interviewee from Startup 1 stated, “We invested many hours informing employees (about GDRR), which was both a financial and organizational burden.” Similarly, Startup 2 explained, “We had to hire a Data Protection Officer (DPO) lawyer … We are spending a lot of time and significant financial resources to be GDPR compliant … ” These findings align with prior research by Tikkinen-Piri et al. (2018), which emphasizes that GDPR compliance demands significant investments in human resources, particularly in employee training. Likewise, Albrecht (2016) highlights the importance of implementing comprehensive training and awareness programs as part of the onboarding process, as these initiatives help startups to manage GDPR requirements but also increase overall expenditures.

The hierarchical regression analysis showed that while regulatory and technical complexities have limited direct effects on GDPR compliance costs, staff training plays a mediating role in these relationships and significantly increasing compliance costs. When staff training is included in the model, the effects of regulatory and technical complexities on compliance costs remain insignificant, indicating that their impact on costs operates primarily through the need for more training. This mediation effect underscores the interconnected nature of GDPR compliance challenges, where complex regulatory and technical demands require investment in workforce training, which in turn drives up overall compliance costs (Figure 4).

These findings could also indicate that businesses investing in staff training to meet GDPR requirements may face higher upfront costs, but these costs are essential for ensuring long-term compliance. Moreover, staff training is not just an independent cost driver but a crucial mechanism through which startups adapt to the demands of GDPR, which aligns with the notion that complex regulations require skilled personnel to implement them effectively (Karippur et al., 2024).

Another objective of the study was to examine whether the respondents’ perceptions of GDPR challenges varied depending on startup characteristics, such as size, age, and business sector.

The results from multiple and hierarchical regression analyses, alongside one-way ANOVA tests, present interesting observations regarding the influence of startup size on compliance costs and staff training. In the regression analysis, where size was included as a control variable, it emerged as a significant predictor of both compliance costs and staff training. However, the one-way ANOVA, which compared distinct startup size categories, did not reveal significant differences across these groups.

Building on this, the findings suggest that larger startups (10–49 employees) face less challenges with compliance costs than smaller ones, likely due to their ability to allocate more resources for compliance efforts. However, staff training remains a significant challenge across all startup sizes, with the smallest and largest startups experiencing the most difficulties. Meanwhile, the influence of startup size on perceived technical complexity appears weaker than in previous studies (Martin, 2023; Magdziarczyk and Widera, 2024). This could mean that perceptions of technical complexity are relatively consistent across different startup sizes, or that the differences may be too subtle to detect with the current sample size. Overall, the size of a startup plays a crucial role in shaping its compliance challenges, with larger startups generally better equipped to handle them (Martin, 2023; Norval et al., 2021), probably due to more structured teams and better access to resources, which helps ease some compliance burdens.

Similar to the results of the regression analysis, the findings from ANOVA tests suggest significant effects of startup age on certain GDPR compliance challenges. Thus, the regression analysis shows that startup age significantly affects technical complexity, with startups in the 6–7 year and 10+ year categories reporting higher technical complexity than younger startups. At the same time, the one-way ANOVA results indicate that startup age has a significant impact on the perceptions of regulatory complexity, specifically with startups aged 4–5 years and 8–9 years experiencing lower regulatory complexity compared to younger startups. This implies that younger startups experience greater regulatory complexity than mid-aged or older ones. This aligns with the insights shared by a 2-year-old Startup 3, which reported severe difficulties in understanding and interpreting GDPR. Lack of awareness and constrained resources contribute to these difficulties (Martin, 2023; Georgiopoulou et al., 2020).

Regarding the business sector, the results of both multiple regression analysis and one-way ANOVA were more aligned. Significant differences in perceptions of compliance costs were found between the reference category ICT sector and leisure and business services sectors, with the latter two perceiving compliance costs higher than their ICT counterparts. This difference in perceptions may stem from the less technical nature of leisure businesses and business services sectors, where companies may struggle to integrate GDPR requirements with existing safety, health, and licensing regulations. In contrast, Mone and Sivakumar (2022) emphasize that sectors relying on advanced technologies, such as AI, cloud computing, and IoT, are more likely to face additional challenges due to the vast amounts of data they process, further complicating GDPR compliance.

Table 8 visually summarizes firm characteristics that significantly influence GDPR challenges and the strength of their effects. The findings our analysis align with the TOE framework, which emphasizes the role of technological, organizational, and environmental factors in an organization’s adoption of new regulations. Specifically, the organizational factor of startup age affects regulatory complexity, which falls within the environmental dimension, as well as technical complexity, which pertains to the technological dimension. Another organizational factor, startup size, influences compliance costs and staff training, both of which form part of the organizational dimension. Furthermore, the environmental factor, business sector, impacts organizational dimension represented by compliance costs and staff training (when acting as a mediator).

The findings of our study suggest several practical implications. Smaller startups experience greater challenges with staff training and higher compliance costs which might imply that tailored subsidized training programs could provide meaningful support to them. Younger startups perceive severe difficulties when it comes to interpreting and understanding GDPR legislation, which means they may need specialized consultancy or legal support for addressing these issues. Moreover, startups operating in highly regulated or non-technical sectors, such as leisure, may require industry-specific regulatory guidance or customized compliance solutions to mitigate the complexities of GDPR compliance.

These results underscore that a one-size-fits-all approach to GDPR compliance might be ineffective. Instead, there is a need for simplified regulatory guidance, accessible technical support, and targeted compliance training programs, particularly for smaller, younger and non-tech startups, to help them address GDPR challenges more effectively. This is especially relevant within the Catalonian startup ecosystem, where around 30% of startups operate in non-technical sectors that often lack in-depth data protection expertise. Government-backed training programs could support startups in overcoming these challenges and create a more GDPR-compliant business environment in the region. The key takeaways from this study are outlined in Figure 5.

The results of this study reveal several key challenges that tech startups face in achieving GDPR compliance. Using the TOE framework, we found that technical complexity, regulatory complexity, and compliance costs are seen as more significant than staff training, with all three factors ranked similarly in importance. Interestingly, while respondents do not see staff training as the primary challenge, further analysis disclosed a strong link between staff training and compliance costs.

Specifically, it was found that the influence of regulatory and technical complexities on compliance costs may be mediated by staff training. Startups that invest heavily in training often incur higher compliance costs, suggesting that as technical and regulatory demands grow, the need for a well-trained workforce also increases. This implies that companies should focus on developing internal organizational skills to face external challenges more effectively. Younger startups, often lacking experience and resources, find regulatory compliance more difficult. Smaller startups struggle with affordability of new hires and complexity of training existing staff. Sectors like leisure and business services, with less technical expertise, view compliance as more expensive compared to ICT firms.

In conclusion, the results of our study underline the interconnected nature of GDPR compliance challenges, with staff training playing a pivotal role in addressing GDPR’s technical and regulatory demands. Startups that invest in developing their teams are better equipped to meet these challenges, although this comes at a financial cost. Furthermore, factors like a startup’s age, size, and sector shape how these challenges are perceived and managed.

For HR teams, policymakers, and industry regulators, this study sends a clear message: it is essential to design training programs tailored to startup size, age and sector. Smaller, younger startups and those in less technical sectors need extra support to handle GDPR. Policymakers, in particular, should work on simplifying regulatory language and creating affordable and accessible GDPR training initiatives for these startups.

For the academic community, the study advances the theoretical application of the TOE framework to the context of GDPR compliance by demonstrating how technological, organizational, and environmental factors shape compliance challenges faced by startups. It refines the role of TOE framework in the adoption of new regulations and introduces its application in the novel context of Catalonia. It also contributes to existing literature by revealing that the increasing complexity of regulations and technical demands indirectly drives compliance costs, primarily through the need for specialized training. This implies that future theoretical frameworks should integrate staff training as a mediating variable in the compliance process. Furthermore, the study also underscores the need to further explore the interplay between staff training, regulatory complexity, technical complexity, and compliance costs, along with their broader impact on business activities. It also emphasizes the importance of organizational characteristics such as firm size, age, and sector, as these factors significantly influence how compliance challenges are addressed.

The societal implications of this study suggest that if startups receive more support from policymakers and local governments in overcoming GDPR compliance challenges in terms of tailored training programs, accessible technical support, and regulation clarifications, it could help create a more secure and privacy-conscious startup ecosystem, ultimately benefiting the broader economy and digital rights protection.

While this study provides valuable insights, it’s important to acknowledge its limitations. Firstly, the study’s sample size, though sufficient for preliminary analysis, is relatively small compared to the total number of startups in Catalonia. This means the results may not be fully representative of the wider startup ecosystem. Larger studies that include startups from various regions in Spain and across Europe would provide a more comprehensive understanding of GDPR compliance challenges across different ecosystems.

Secondly, relying on self-reported survey data introduces the risk of response bias. Respondents might have overstated or understated certain challenges due to personal perspectives, roles within their organizations, or lack of knowledge about GDPR compliance. Additionally, the decision to treat “I don’t know” responses as neutral (midpoint) could also skew results, potentially underestimating certain challenges or masking real uncertainty of the respondents.

Thirdly, the focus on Catalonian startups limits the generalizability of the findings to other regions, even within Spain, due to differences in regulatory interpretation, industry focus, and government support. Furthermore, the study explored industry-specific challenges only to a limited extent. Startups operating in fintech, foodtech, telecom, advertising, or edtech may experience GDPR compliance differently due to sector-specific requirements. Future research should explore these differences through comparative studies to distinguish between universal GDPR challenges and those unique to particular industries or sectors.

Lastly, the study’s cross-sectional nature limits our understanding of how GDPR challenges evolve over time. Startups may face different challenges at various growth stages, and a longitudinal approach could provide deeper comprehension of how startups’ compliance strategies adapt as they grow and mature. This could help to identify long-term compliance challenges that might not be visible in a cross-sectional study and provide more practical recommendations on guiding startups through data privacy regulations while also helping them to achieve growth in a GDPR-compliant way.

Our findings on GDPR compliance challenges contribute to the ongoing discussion on how firms with various characteristics address new regulations. While some startups aim to meet only the minimum legal requirements, others exceed these standards by integrating compliance into their business strategies, which not only improves their operations but can also foster the development of innovative business models. The differences in how startups approach GDPR compliance based on their size, age and sector raise important questions for future research. Specifically, it remains unclear what factors determine whether a firm adopts a minimal compliance approach or pivots its business model to integrate regulatory changes. There is a notable gap in the literature on how data protection regulations, like the GDPR, impact entrepreneurial decision-making, business model innovation, and the overall entrepreneurial ecosystem.

We propose that future research explores the theoretical foundations of how data protection regulations influence entrepreneurship, especially how these regulations may either constrain or boost entrepreneurial potential. Prospective research should also investigate how data protection strategies can also serve as a source of innovation within the entrepreneurial context. This paper encourages scholars to examine how compliance influences various business model aspects, such as innovation, strategic decision-making, and market positioning.

Likewise, future research could explore how GDPR compliance contributes to a startup’s competitive advantage. Beyond being a mere legal obligation, compliance may serve as a strategic tool that fosters customer trust, creates a reputation for data responsibility, and differentiates startups from competitors. This perspective opens new avenues for exploring how firms can leverage compliance as part of their corporate social responsibility (CSR) strategy to align with broader ethical and social goals of increasing brand value and improving customer loyalty.

Furthermore, there is potential to investigate the role of incubators and accelerators in guiding startups through GDPR compliance. These entities could serve as critical resources, helping new ventures address the complexities of data protection regulations and offering tailored support to integrate compliance into their business models. Research into the involvement of such support organizations could yield valuable policy recommendations on how incubators can help startups mitigate the regulatory burden and facilitate their long-term success.

This research lays the foundation for developing a theoretical framework that links data protection, entrepreneurship, and business model evolution. By exploring these areas further, future studies can deepen our understanding of how regulations like the GDPR shape the entrepreneurial landscape. Additionally, this research can offer policymakers new strategies and frameworks to help startups overcome technological, organizational, and environmental challenges, ultimately fostering innovation and growth within the startup ecosystem.

Compliance costs

1. GDPR is expensive to comply with

2. It is costly to invest in GDPR consultants

3. It is costly to invest in new hires to meet the demands of GDPR

Staff training

1. It was challenging to train existing employees about GDPR requirements

2. It is challenging to train new employees about GDPR requirements

3. It was difficult to change the company mindset to ensure that each employee follows GDPR principles

Regulatory complexity

1. There is a lack of information support from the government bodies in relation to GDPR

2. There is a lack of practical guidelines from the government bodies to follow standard procedures correctly

3. GDPR does not provide any recommendations regarding the use of technology helping to comply with its requirements

4. GDPR does not provide any specific instruments or tools for companies

Technical complexity

1. It is not easy to develop a cyber incident response plan

2. It is challenging to apply emergent technologies (artificial intelligence, robotics, cloud computing, blockchain, etc.) to achieve better compliance with the GDPR

3. It is complex to execute periodic audits to ensure that all processes are compliant with GDPR

Source(s): Authors’ own work