What you actually have to do
Tell people what data you collect (privacy policy). Get consent for non-essential cookies (cookie banner — but only if you use non-essential cookies). Let people request and delete their data. Encrypt data in transit (HTTPS) and at rest. That's the core 90%.
Pick GDPR-friendly tools by default
Plausible instead of Google Analytics (no cookie banner needed). Stripe for payments (already compliant). Resend or Postmark for email (EU options available). Host in the EU or UK if your users are there. Skip the cookie banner entirely if you can.
Privacy policy: don't write it yourself
Use Termly, iubenda or a competitor's policy as a starting template (rewrite, don't copy). Update it as you add services. A $10/month tool beats a $500 lawyer letter for an MVP.
Data deletion: build it in week one
A simple 'Delete my account' button that actually purges user data. Required by law, expected by users, and 100x easier to build at the start than to retrofit later when you have foreign keys everywhere.
When you do need a lawyer
Processing health data, biometrics, children's data, or anything political/religious. Selling to enterprise (they'll send you a DPA). Raising venture funding. For a B2C or B2B SaaS MVP, the checklist above gets you 95% of the way.