You have to identify your data class which takes a lawyer. You have to assure that no data is held longer than 48 hours even telemetry without providing an export and delete function. You have to support level 4 data requests which will take a lawyer.

Just like all regulation its very doable but its way more cost effective for the big players.