GDPR is easy when your only income is what your users pay you and you are not interested in their personal data. My company barely changed some internal documents and that was it.