As for startups: depending on what kind of personal data you are collecting, being GDPR complicit shouldn't take more than a day.
If it takes longer you are building a business around personal data, and I think you should know your stuff (not just GDPR, but also what kind of data you are collecting and why).
either you're overly optimistic, or you have some 100x rock star doing the impl. because it took over 1 year to implement all of the GDPR required features for me, and we don't even store that much private data!
How long it takes obviously depends on your data - but also on how important privacy and security is for you already. In my case, privacy was already important, so there wasn't much to do.
Unless you were in charge of GDPR compliance for an enterprise-size company, I don't know how you could possibly take a year about it, even if you had previously not cared a jot about your user's data?
> we don't even store that much private data!
What do you store? Because I can't imagine what would take that long.
What have you spend 1 year doing if I may ask? Did you previously store passwords in plain text and you had to update that?
And you should probably pause and ask whether your proposed business will provide a net benefit to the world, or if it's just an attempt to make money regardless of the consequences to society.
Not to say there aren't any worthwhile businesses to be created around personal data, but experience suggests that some skepticism is in order.