GDPR issn't that hard to achieve. You simply need to follow the rules and fill out some "paperwork". If you are smart, you make your life easier with ISO27001 (don't need to certify, but build upon it).