Startup Legal Basics
Foundational legal checklists for early-stage startups. This is not legal advice; use it to prepare and to work efficiently with qualified counsel.
When to Use
- Choosing an entity setup and getting incorporation done
- Ensuring founders and contractors assign IP correctly
- Building a sane contracting process (MSA/SOW, DPA, basic procurement flow)
- Privacy basics: data mapping, roles (controller/processor), and policy scope
- Legal readiness for first customers and light fundraising prep
When NOT to Use
- Jurisdiction-specific legal advice or interpretation of laws
- Complex regulated domains (health, finance, children’s privacy) without counsel
- Deep security compliance programs (SOC 2/ISO) -> qa-observability (technical controls) + dedicated compliance work
Quick Start (Inputs)
- Primary jurisdiction(s): founder location, customer location(s)
- Entity goal: bootstrapped, VC-backed, or uncertain
- Product type: SaaS, marketplace, services, hybrid
- Data: what personal data is collected, and what third parties receive it
- Selling motion: self-serve terms vs negotiated B2B contracts
Workflow
- Entity and ownership setup
- Decide: LLC vs C-Corp (or local equivalent) based on funding expectations and tax/legal advice.
- Ensure founders have signed equity and IP documents early.
- IP assignment and contractor hygiene
- Founders: assign IP to the company; confirm prior employer/IP constraints.
- Contractors: use written agreements with IP assignment + confidentiality.
- Contracting basics for selling
- Decide your default contract stack: click-through terms vs MSA/SOW.
- Add a simple “contract intake” flow to avoid random obligations.
- Privacy fundamentals (minimum viable)
- Create a data map (what you collect, why, where it goes, retention).
- Decide your roles: controller/processor where relevant.
- Ensure your policies match reality (do not claim controls you do not have).
- Fundraising readiness (light)
- Keep a basic corporate record set (cap table, key agreements, IP assignments).
- Avoid “side agreements” that complicate diligence later.
Resources
| Resource |
Purpose |
| entity-and-ownership-basics.md |
Entity decisions, founder docs checklist |
| contracting-basics.md |
Contract intake, common clauses, red flags |
| privacy-basics.md |
Data map, privacy roles, policy scope |
| ip-protection-guide.md |
IP types, assignment, open source licensing, trademark and patent strategy |
| employment-law-basics.md |
Worker classification, employment docs, non-competes, international hiring |
| terms-of-service-guide.md |
TOS drafting, SLA design, DPA requirements, cookie consent, enforceability |
| equity-agreements-guide.md |
Founder equity splits, vesting schedules, 83(b) elections, advisor agreements |
Templates
Data
Common Mistakes
| Mistake |
Consequence |
Prevention |
| Verbal equity promises |
Legal disputes, cap table chaos |
Written agreements only |
| Missing 83(b) election |
6-figure tax liability on illiquid stock |
File within 30 days, calendar immediately |
| No contractor IP assignment |
Company doesn't own code/content |
Agreement signed before work starts |
| Policy/practice mismatch |
Regulatory liability, failed audits |
Data map validates privacy policy claims |
| Side deals with advisors |
Due diligence failure, cap table mess |
Everything documented in cap table |
| Unlimited liability accepted |
Existential risk from customer contract |
Cap at 12-24mo fees paid |
| Cookie banner doesn't block |
GDPR violation |
Test that cookies actually wait for consent |
| No DPA with vendors |
GDPR violation when processing EU data |
DPA with every vendor handling PII |
What Good Looks Like
- Every contributor who writes code/content has signed a valid IP assignment to the company.
- You have a repeatable contract intake process and a default position on key terms.
- You know what data you collect and can explain it consistently across product, contracts, and policies.
- Your cap table is clean and matches all signed agreements.
- You can respond to a GDPR rights request within 30 days.
