Startups need to have relevant controls to protect against reasonably foreseeable threats to security, confidentiality and integrity of a consumer's personal information.