Its not as daunting as it may seem. After all the law doesnt expect systems to be unhackable. The expectation is that you show care with other peoples data. This is normally handled with a policy document and someone to sign off that new developments follow it
1: define what data is personal (read the law)
2: Dont collect it unless you need it
3: Write down why you need it and how long you need it for
4: Tell the customer why you need it and ask them to confirm its ok
5: encrypt it
6: delete it when you are done
Third party services can offer you some plug and play solutions for example payments or authentication via facebook etc.
But when it comes to simple customer data like names and addresses you have to consider that sending to third parties is exactly the kimd of thing people dont want you to do with it.
If you need the data to run your business then you are probably better off with your own database. If you dont need the data, just dont ask for it.
I guess most internet startups these days will be looking at getting a high valuation based on the number of users and potential leverage of the data you hold on the users.
This unfortunately puts you in direct opposition to the spirit of data protection laws and limits your use of third parties.
I dont think this problem has been solved yet, esp. When you consider the age of your users may prevent them from legally agreeing to your tncs