It's a great question and one of the common complaints to the wave of privacy regulations. I believe that it's not a ton of work, but may be a bit of legalese to wade through and should be basic due diligence for collecting personal information.
There is a lot in GDPR, but here's a list of possibilities that will honor the spirit of the law and be huge steps forward:
- Privacy policy: Write a human-readable privacy policy and publish it. It should declare what you collected, for what purposes, how long it's retained and how to contact the privacy office for data subject requests.
- Conduct an internal Privacy Impact Assessment: an inventory of personal data collected, for what purpose, what is it's risk/danger level, what lawful reason is it collected/processed, where is it stored and what is the retention policy.
- Lawful processing: For each of the types of data collected, determine the lawful umbrella for collecting and processing it; GDPR defines a bunch but most people use only "legitimate interest" or "explicit consent". If you need to use consent, find a vendor to help you manage it.
- Honor data subject requests for access/portability/erasure. Doesn't have to be fancy, can even be just a mail to privacy@yourdomain. Don't forget to authenticate/vet the requestor to avoid leaking data.
- Vendors/3rd party companies you use: Inventory them and record what data is going to them. Will likely have in contracts their obligations under GDPR, and will define their role ('processor' or 'controller').