Startups and SMB collect and process personal data, including that of their clients, suppliers and employees. Their stakes are high, because in order to work with other organizations and not risk a conviction at the CNIL (National Commission for Information Technology and Civil Liberties), they need to make sure they comply with the GDPR.