# Founder data privacy: GDPR for venture capital funds

> GDPR for venture capital funds mostly concerns founder data: names, contact details, CVs, interview recordings and anything personal in decks and data rooms. If the GDPR applies, the fund is usually the controller, because it decides why and how that data is used. It needs a legal basis, a privacy notice at collection, a retention period, security, and written contracts with any processor, such as its deal flow software. This is general information, not legal advice.

Source: https://delsivo.com/founder-data-privacy-for-vc-funds · Updated 2026-11-06

Venture funds handle more personal data than they tend to think. An application form collects founders' names, emails and phone numbers. A deck includes team biographies and sometimes photos. A data room may hold employment contracts, salary details and customer contact lists. An interview recording captures a person's face and voice. All of it is personal data about real people who did not sign up to be part of a fund's database forever.

In practical terms, GDPR for venture capital funds comes down to a few questions: when the regulation applies to founder data, what being a controller means, what to tell founders, how long to keep their data and what to check in the tools you use. The rules quoted come from the text of the regulation as published on gdpr-info.eu and read on the date shown in the sources. Your counsel should confirm how they apply to your fund, and the UK, India and other jurisdictions have their own laws.

## When the GDPR applies to a fund

Article 3 sets the territorial scope. The regulation applies to processing in the context of the activities of an establishment of a controller or processor in the EU, regardless of whether the processing itself takes place in the EU. It also applies to organisations not established in the EU when they process personal data of people in the EU and the processing relates to offering them goods or services or to monitoring their behaviour there.

In practice, a fund with an office or team in the EU should assume the GDPR applies to its founder data. A fund outside the EU that receives applications from EU founders should take advice on whether Article 3(2) reaches it, and many choose to follow the same practices anyway because founders expect them. The UK has its own version of the GDPR, which is close to the EU text.

## GDPR for venture capital funds: controller and processor

Article 4 defines a controller as the person or body that, alone or jointly with others, determines the purposes and means of the processing of personal data, and a processor as one that processes personal data on behalf of the controller.

For founder data, the fund is usually the controller. It decides to collect applications, what to ask, how to assess them, who sees them and how long to keep them. A deal flow tool, application portal or data room provider that handles that data on the fund's instructions is usually a processor. Being the controller means the fund carries the main responsibility: Article 5(2) says the controller shall be responsible for, and be able to demonstrate, compliance with the principles.

Article 28 sets out what a fund must have in place with each processor. It may use only processors that provide sufficient guarantees of appropriate technical and organisational measures. The contract must require the processor to act only on the controller's documented instructions, keep staff bound by confidentiality, apply the security measures in Article 32, follow conditions before engaging sub-processors, help the controller respond to individuals' rights requests, delete or return the data at the end of the service, and make information available for audits.

## The principles, applied to deal flow

Article 5 lists the principles that govern all processing. Each translates into something concrete for a fund.

GDPR Article 5 principles and what each means for founder data at a venture fund

| Principle (Article 5) | What the text says | What it means for a fund |
| --- | --- | --- |
| Lawfulness, fairness, transparency | Processed lawfully, fairly and transparently | A legal basis for each use and a clear privacy notice on the application form |
| Purpose limitation | Collected for specified, explicit and legitimate purposes | Application data used to assess the application, not added to a marketing list |
| Data minimisation | Adequate, relevant and limited to what is necessary | Ask only for what you use at each stage; no passport scans at first screen |
| Accuracy | Accurate and, where necessary, kept up to date | Let founders correct their details and extracted facts |
| Storage limitation | Kept no longer than is necessary | A set retention period for passed applications, decks and recordings, then deletion |
| Integrity and confidentiality | Appropriate security of the personal data | Access controls, encryption, care with data room sharing and exports |
| Accountability | The controller is responsible and able to demonstrate compliance | Written records of what you collect, why, where it goes and for how long |

## Legal basis and what to tell founders

Article 6 lists the legal bases for processing. Three are most relevant to funds. Consent, where the person has agreed to processing for specific purposes. Contract, which covers processing needed to take steps at the person's request before entering into a contract. And legitimate interests, where the fund's interests are not overridden by the person's rights and freedoms. Which basis fits each use is a question for your counsel, and it may differ between, say, assessing an application and sending a newsletter.

Article 13 sets out what to tell people when you collect data from them, such as on an application form:

- Who the controller is and how to contact them, and the data protection officer if you have one.
- The purposes and the legal basis, including the legitimate interests relied on if that is the basis.
- Who receives the data, such as co-investors, advisers or software providers, and any transfers outside the EU.
- How long the data is kept, or the criteria for deciding.
- The person's rights, including access, correction, erasure and complaint to a supervisory authority.
- Whether any automated decision-making is involved, with meaningful information about the logic.

Article 14 covers data you did not collect from the person directly, such as a founder's details from a referral or co-founder bios in a deck. It generally requires the same information within a reasonable period and at the latest within one month, subject to exemptions. Article 22 gives people the right not to be subject to a decision based solely on automated processing that significantly affects them, which is one more reason to keep a person responsible for every screening decision.

## A practical checklist for fund teams

1. Map your founder data: what you collect at each stage, where it is stored, who can see it and which tools touch it.
2. Write a short privacy notice for founders and link it from your application form and portal.
3. Choose a legal basis for each use with your counsel, and record it.
4. Minimise: remove fields you do not use at the first screen, and limit what you ask for in data rooms.
5. Set retention periods, for example for passed applications, interview recordings and data room files, and delete on schedule, including copies in email and shared drives.
6. Sign a data processing agreement with each processor, and keep a list of their sub-processors.
7. Keep people responsible for decisions, and be able to explain how any automated assessment works.
8. Prepare for requests: know how you would find, export or delete one founder's data within the time the law allows.

Common mistakes include forwarding decks around personal inboxes, keeping every application forever "in case", sharing data rooms with no expiry, and assuming a vendor's terms of service are a processing agreement. Our guide on [what goes in a startup data room](https://delsivo.com/what-goes-in-a-startup-data-room) covers limiting personal data in rooms.

## Where Delsivo fits

Delsivo is designed with the fund as the controller of founder data and Delsivo as its processor, under a data processing agreement. Each fund's data is separated in the database, and one permission check covers pages, search, AI retrieval, exports and notifications. Private storage is encrypted at rest, uploads are scanned for malware before preview, and access to files uses short-lived signed links after a permission check.

Retention for decks, recordings and transcripts is set by the fund, and deletion removes previews, search indexes and derived copies as well. Founders can correct extracted facts, with the original kept and both visible to the fund. People make every decision. Nothing about this is certified: Delsivo is at the design partner stage, and AI providers are to be confirmed under terms that do not train on submitted content before customer content is processed. See [GDPR at Delsivo](https://delsivo.com/gdpr), our [data processing agreement](https://delsivo.com/dpa) and [security](https://delsivo.com/security).

## Questions

### Is a venture fund a data controller under the GDPR?

Usually, for founder data it collects. A controller determines the purposes and means of processing, and a fund decides why it collects applications, what it asks and how it uses them. Software providers acting on its instructions are usually processors.

### Do funds need consent to process startup applications?

Not necessarily. Consent is one of several legal bases in Article 6, alongside steps taken at a person's request before a contract and legitimate interests. Which fits depends on the use, so check with counsel.

### How long can a fund keep a founder's deck after passing?

The GDPR sets no fixed period. Its storage limitation principle says personal data should be kept no longer than necessary. Set a retention period, tell founders in your notice and delete on schedule.

### Can a fund use AI to screen applications under the GDPR?

It can use AI to assist, but Article 22 gives people the right not to be subject to decisions based solely on automated processing that significantly affect them. Keep a person responsible for each decision and explain the logic in your notice.

## Sources

- [GDPR, Article 3: Territorial scope](https://gdpr-info.eu/art-3-gdpr/) (checked 2026-11-06)
- [GDPR, Article 4: Definitions](https://gdpr-info.eu/art-4-gdpr/) (checked 2026-11-06)
- [GDPR, Article 5: Principles relating to processing of personal data](https://gdpr-info.eu/art-5-gdpr/) (checked 2026-11-06)
- [GDPR, Article 6: Lawfulness of processing](https://gdpr-info.eu/art-6-gdpr/) (checked 2026-11-06)
- [GDPR, Article 13: Information to be provided where personal data are collected from the data subject](https://gdpr-info.eu/art-13-gdpr/) (checked 2026-11-06)
- [GDPR, Article 14: Information to be provided where personal data have not been obtained from the data subject](https://gdpr-info.eu/art-14-gdpr/) (checked 2026-11-06)
- [GDPR, Article 22: Automated individual decision-making, including profiling](https://gdpr-info.eu/art-22-gdpr/) (checked 2026-11-06)
- [GDPR, Article 28: Processor](https://gdpr-info.eu/art-28-gdpr/) (checked 2026-11-06)

## Related pages

- [GDPR at Delsivo](https://delsivo.com/gdpr)
- [Data processing agreement](https://delsivo.com/dpa)
- [Data controller and processor, defined](https://delsivo.com/glossary/data-controller-and-processor)
- [Security](https://delsivo.com/security)
- [How to say no to founders](https://delsivo.com/how-to-pass-on-a-startup)