The law is quite readable, and the various Data Protection Agencies (country-specific regulators) have provided more concrete guidance. If you're setting up a website that takes a restrained approach to personal data, you don't necessarily need an attorney.

Databunker turns basically any startup to be privacy by design compliant.

how does it address ip addresses in server logs?

Take a look at this article: https://www.freecodecamp.org/news/how-to-stay-gdpr-compliant...

> Otherwise this is just another way to add barriers.

Personally I think pretty much everything in GDPR is just sensible guidelines for how to handle personal data, and if you're not willing to do those things then you probably shouldn't be handling personal data in the first place. Being ignorant of good data practice is not an excuse.

> If you are on modest income you can forget about setting up a website in the EU.

This is just rubbish. GDPR only applies to personal info for a start so if you don't store personal info then you have nothing to worry about. Even if you do store personal info the vast majority of use cases are really straightforward and require a very minimal understanding of the law to be compliant.

Furthermore you can often ask them for help (or so I have heard).

> GDPR is just sensible guidelines for how to handle personal data

And yet it doesn't say "don't give it to me if you don't want me to have it."

> GDPR only applies to personal info for a start so if you don't store personal info then you have nothing to worry about.

So logging IPs is fine?

IP addresses are (probably) considered personal data under the GDPR.

https://www.fieldfisher.com/en/services/privacy-security-and...