You're a 12-Person Startup. Here's the Order to Do Compliance In.

If you have twelve people and a growing customer list, do these things in this order: know what data you hold, control who can reach it, write the two policies that are legally required, make retention real, then pursue a certification only when a deal depends on it. Most startups do that list backwards, starting with the certification because an enterprise buyer named it, and spend three months building evidence for controls that do not exist yet.

Stage one: know what you hold

Two weeks, one person, and it makes everything after it cheaper.

Build a rough data flow map: what personal information you collect, where it enters, which systems hold it, which third parties receive it, and where it lives geographically. Do not buy a tool for this. Interview four people and write it down.

You are looking for three specific answers, because everything downstream depends on them. Can you produce all data about one individual on request? Do you know every third party that receives personal information? Does anything leave Canada, and did anyone assess that?

If any answer is no, that is your first project. Certification cannot substitute for it, because the auditor will ask the same question and you will not have an answer then either.

Stage two: control access

The single highest-value control at this size, and the cheapest.

Turn on multi-factor authentication everywhere, remove access when people leave on the day they leave, use groups rather than individual grants, and review who has access to production data once a quarter. That is the whole stage. It closes more real risk than anything else you can do in a month, and every framework you might later pursue asks for it.

The one addition worth making early: separate access to production customer data from access to everything else, and keep the list of people with production access short enough to recite from memory.

Stage three: write the two documents you actually need

A privacy policy that matches what you really do, and an internal incident response procedure. Not a policy library.

The privacy policy matters because it is the promise regulators and customers hold you to. The most common startup failure is not an absent policy; it is a policy describing a company you are not, usually copied from someone larger. If it says you conduct annual third-party penetration testing and you do not, you have created an exposure that did not previously exist.

The incident procedure matters because incidents happen at the worst possible time and the decisions are hard. It needs to be one page: who decides, who investigates, who notifies, and the triage questions that determine your reporting duty. Everything else can wait.

Stage four: make retention real

The stage everyone skips, and the one that reduces breach impact most.

You cannot lose data you no longer hold. Pick your three largest stores of personal information, decide how long each category genuinely needs to be kept, and implement actual deletion. Not a policy describing deletion. Deletion.

This is unglamorous and it will surface awkward questions, particularly about backups and analytics exports. Answer them now, while the volume is small. A retention schedule implemented at twelve people is a week of work; at eighty people it is a quarter.

Stage five: certification, when a deal requires it

Not before. And when you do, let the deal define the scope.

The reason to wait is not that certification lacks value. It is that a certification obtained before stages one to four exist certifies a programme with no substance, costs the same money, and has to be redone properly at the next cycle. Stages one to four are what the audit examines. Build the thing, then have it inspected.

What should you deliberately postpone?

Say no to these until something forces the issue: a full policy library, a formal risk register with scoring, a management system in the ISO sense, a dedicated compliance hire, and any tool that costs more per year than the risk it addresses.

I would rather see a twelve-person company with a real access review, enforced retention, an honest privacy policy, and no certifications than the reverse. The first company is genuinely safer. The second has documents.

For where this leads over the next two years, the privacy program maturity model sets out the stages and where to stop.

This is general information, not legal advice.

Valdra was built for the company at stage one, not the company at stage five: the register, the assessments, and the evidence accumulate as you go, so the certification later has something to examine.