Zirlandia Milkovic of GDPR Gard on Why GDPR Belongs in the Product, Not Just the Privacy Policy
Zirlandia Milkovic is a developer and GDPR consultant based in Rijeka, Croatia. She is the founder of GDPR Gard and the author of "GDPR Made Simple for Women Founders".
In this Q&A, Zirlandia shares where small teams most often slip up when they build GDPR into their product, what founders still get wrong about consent, and which privacy rules and enforcement trends are worth watching over the next year.
Her perspective offers a practical way to treat privacy as part of the product rather than a one-off legal document, along with simple checks founders can run on their own site today.
Know a woman leader doing incredible work? The Founded by Women Awards are open for entries - founders, executives, professionals and changemakers alike. Showcase your story, gain visibility and connect with a community of leaders. 👉 foundedbywomen.org/awards
Q: Where do small teams slip up most often when they build GDPR into their product?
They treat GDPR as a legal document instead of a product feature. The privacy policy gets written once, but the product keeps changing: a new analytics script, a new email tool, a new form field. The most common gap I see is data flowing to third-party tools that nobody has listed or covered with a contract. The fix is simple: keep a living list of every tool that touches personal data, and update it every time you ship something new. Also collect only what you actually use, because data you never gather can't leak.
Q: What do founders still get wrong about consent?
They think a banner equals consent. In audits I constantly see analytics and marketing cookies firing before the visitor clicks anything, "Accept" buttons that are big and colorful while "Reject" is hidden in a second layer, and pre-ticked boxes. Under GDPR, consent has to be freely given and as easy to refuse as to accept, and nothing non-essential should load until the person says yes. A quick test: open your site in a private window, don't click the banner, and check which cookies are already set.
Q: Which privacy rules or enforcement trends should founders watch over the next year?
Three things. First, regulators are increasingly looking at cookie banners and dark patterns, so the consent issues above are a real risk, not a theoretical one. Second, the EU AI Act is phasing in, so if you add AI features you'll need to think about transparency and what data you feed into models. Third, data transfers outside the EU: know where your tools store data and keep an eye on the EU–US Data Privacy Framework, since it may be challenged again.
For anyone who wants a quick starting point, our free 30-second audit at gdprgard.eu checks a site against 10 GDPR requirements, with no signup.
Are you a woman leader with an inspiring story? Founded by Women elevates the voices of women making an impact.
Breaking barriers or paving the way for others? We'd love to feature you. Get in touch! 👉 hi@foundedbywomen.org
