The GDPR really isn't that hard to follow, for a "mom & pop" business, it really comes down to:

  * Limit data retention — Don't keep personal data longer than necessary
  * Honor data subject rights — Allow individuals to access, correct, delete, or port their personal data

Simply, don't collect personal information if you don't need it. If you do need it, add a delete button.