Startup legal — the operator's orientation

For most first-time founders, the actual minimum is shorter than online "checklists" suggest:

1. Entity — appropriate for your country and tax situation. (C-corp Delaware for US venture-backable, LLC for US lifestyle, Ltd in UK, Pty in AU, etc.)
2. Founder agreement — even if solo. Vesting, IP, equity split, what happens if a co-founder leaves.
3. IP assignment — every founder, every contractor, every employee, in writing, assigning their work to the company.
4. Privacy policy + terms of service — required by app stores, payment processors, and most jurisdictions if you serve EU/UK users.
5. Standard customer agreement — even one paragraph is better than nothing.
6. Tax registration — VAT, sales tax, etc. as appropriate to your country.

Anything else (employment law, securities filings, complex IP) depends on stage and country.

Even if you're solo today, write a one-page founder agreement now. Future-you will thank you.

What it should cover:

• Equity split. And the principle behind it. 50/50 is not the answer just because it's fair on day one.
• Vesting. Standard is 4 years with a 1-year cliff. The founder who leaves at month 8 shouldn't keep 50%.
• IP assignment. All work product belongs to the company.
• Decision rights. Who decides hiring, fundraising, product direction? Define before you disagree.
• Exit triggers. What happens if a founder wants to leave? What if you both want different things?

The cost of writing this in year 1 is ~$1k. The cost of fixing it in year 3 after a fight is often the company itself.

If you serve EU/UK users (you almost certainly do unless you've blocked them at the firewall), the minimum:

• Privacy policy that's accurate, not boilerplate. Generic policies copied from another site fail any real audit.
• Lawful basis documented for every data collection point (consent, contract, legitimate interest).
• Data deletion mechanism. Users must be able to delete themselves.
• Sub-processor list, kept current. Every SaaS that touches user data needs a signed DPA.

When to actually worry beyond this:

• 250+ employees
• Regulated industries (health, finance, education of minors)
• Special category data (health, biometric, etc.)

The GDPR for Tiny SaaS guide covers the practical pieces.

Most founders either over-lawyer (paying for unnecessary advice early) or under-lawyer (skipping advice when it would have saved a year of pain). Real triggers to talk to one:

• Before you sign a term sheet, ever. Worth the $1-2k.
• Founder split disputes beyond what your founder agreement covers.
• First employment offer if you're operating in multiple countries.
• Customer contract with a Fortune 1000. Their paper is built to bury you; you need help to negotiate the bury-clauses.
• Trademark dispute of any kind.
• Privacy / data breach. Even small ones in regulated industries.

Don't call one for: routine privacy policy boilerplate, basic SaaS terms, standard contractor agreements. Templates work; one annual review is enough.