I've been managing it myself over the past couple months mainly by working on getting my privacy policy and terms of service updated to cover GDPR, and how that

I've been managing it myself over the past couple months mainly by working on getting my privacy policy and terms of service updated to cover GDPR, and how that affects both EU and non-EU customers (I'm applying GDPR to all customers, because I think privacy is important, and because it's easier to implement when it's "across the board"). Updates include things like a detailed disclosure of all data that is collected that could be considered PI (IPs, machine fingerprints, names, emails, etc.), GDPR-related requests, the third parties (sub-processors) I use to run my business, and the responsibilities of my company as a data processor, and my customers' responsibilities as data controllers. I've been looking over a lot of other GDPR privacy policies and terms as inspiration, so I know what needs to be covered for my particular business, to see how they go about structuring their contracts, etc. That, and I have been implementing adjustments to data retention (logs, backups, etc.), explicit consent, record deletion (luckily I never did soft deletes), etc. I may hire a tech lawyer to look it over after I'm done and recommend that I make adjustments where needed.