I know that the European DPA/GDPR has made being a data controller a non-trivial thing, for several years.

I’m working on a social media-style app that needs to take very good care of its member data. Many folks here would probably be appalled at the measures I’m taking.