Often, yes. Privacy obligations frequently turn on the type and volume of data you handle, not just your headcount or revenue. Startups and small companies that collect and process personal information are squarely within the scope of many regulations. A compliance assessment is the best way to know exactly where you stand.