I run a small SaaS business, which doesn't do anything ethically questional with user data, and becoming compliant involved:
- writing a document on GDPR compliance
- changing a few settings so IPs aren't logged or are at least anonymised
- verifying log files aren't kept longer than needed and don't contain personal information that isn't needed
I don't even need a popup asking for users to give permission to store personal information, because I'm not doing anything that needs that.