Why do you think the document needs to be vetted by a lawyer?

The regulation makes repeated reference to proportionality.

> Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary.

For a simple forum this is a simple privacy policy.

And forums should already have something like this if they're complying with EG US COPPA or similar.

What if a forum owner receives a DMCA letter, or a letter from NSA? You do not really need to consult a lawyer to remove copyrighted material or something else that is illegal.

A single DMCA notice is relatively easy to deal with. Even though a startup owner probably "should" consult with a lawyer, you don't need to if the take-down request is clear and the material is either clearly infringing or not. There are gray areas, but they are rare.

A letter from the NSA is a completely different story. You definitely need to hire a lawyer, probably an expensive one. One NSA letter could easily shut down a small startup.