Two options: launch on unregulated market first or just ignore* compliance until risks for customers are high enough.
*do not mention it in written form, just have some paperwork that work is in progress.
And what are the consequences if something goes wrong? Does the executive team go to prison? Usually doesn't happen to the well-connected, but what if you're not well-connected?
Personally, I wish the laws were rational, and scaled according to the size of a business, rather than relying on the whims of prosecutorial discretion.
Random theory: if the law creates many risks even for people who are trying to be moral, risk-averse people will be less likely to start businesses. More businesses will then be started by people who disregard risk, and also selects for a disproportionate number of people with serious psychological issues (although still a small percentage, but higher than the general population). What kind of filter do you have, when people starting certain businesses need to be comfortable rolling the dice on a 1% or 5% chance of going to prison for no intentional reason, and a chance at a pile of cash if that doesn't happen? It sounds like it selects for the same psychology as criminals.
> launch on unregulated market first
There are fewer and fewer of those all the time, and the ones that remain are in smaller and smaller, less profitable niches. So that technically opportunities exist, but as a practical matter fewer and fewer people are able to ascend the success ladder.
A five-person startup shouldn’t leak my data just because they share passwords and it were not mandatory to have a GDPR person at that size.
If some rule is broken it is not a big deal if there is no harm to anyone. Nobody is 100% compliant with all regulations, but the companies which approach this matter pragmatically, following the spirit rather than the letter of the law, usually do not have problems. E.g. if you are health-tech startup, you must avoid any health-related risks and prevent data leaks, but you may not serve GDPR requests perfectly. At worst regulator will warn you and then you will invest your resources in fixing the issue. And preventing data leaks is also easier for an obscure early stage startup: you simply get less attention from malicious actors and will likely encounter automated attacks rather than being specifically targeted.
But there's no guarantee of this right? According to the law, if they wanted to destroy your company over some tiny accidental rule breakage, they could. It just depends on if you're on someone's list or they're having a bad day. Unpredictable application of the law is not great.