Those that focus more on technology instead of the product often fails, unless technology is the actual startup (database companies, PaaS etc.). Even then it is often a good choice just to select something "boring" that everyone knows.

That's not true. I work in an European company and we were contacted by the agency to give a complete list of partners that we use, reasons for why it is justified, which routines we have for deleting old data etc.

I guess in theory we could have lied and made up data, but only an idiot would risk lying to the government. Everyone at my company took it seriusly and tried to provide as accurate data as possible. There were also several follow up questions that had to be answered.

The mindset of lying to the government to "protect" your employer seems so far fetched. Why should an employee lie to the government? If it turns out that the company was in violation of GDPR the worst case scenario for the company is a fine. If the government finds out you are lying, the employee faces jail time. The trade-off is simply not worth it.

Maybe it's easier to lie to the government in some countries, but not in my country. The government agencies actually checks and verifies your claims.