If he's already handling the data securely and only keeping the data necessary for the service (which I doubt but we'll never know) all he has to do is:

- Appoint a data protection officer (himself)

- Write down the processes of how he stores data (we keep it on this database, hosted at x provider; that provider is called the data processor) and how he deletes data whenever the subject of the data requires it.

That's it.