Younneed a DPO if you 10 employees or more. Fornhiavcase, he most likely just needs to update his privacy policy and have a form to collect users requests (like TypeForm) and make sure that he handles them (event if it's manually deletion in database).