> I do not have the resources to hire a Data Protection Officer (DPO) or EU Representative as required by GDPR.
A DPO is most certainly not required by all organisations[0], and I would be suprised if it applied to this project. I know lots of blogs are saying it is, but it is simply untrue. I'm not saying that this totally relieves the burden however.
[0]:https://ico.org.uk/for-organisations/guide-to-the-general-da...