It’s hard to give general advice without knowing your specific situation. Ignoring GDPR has serious risks, though, as you already said. In my company (Germany)

It’s hard to give general advice without knowing your specific situation. Ignoring GDPR has serious risks, though, as you already said. In my company (Germany) we work together with an external data protection officer, who was of great help for us dealing with the GDPR requirements. So maybe you find it worth talking to one, just to get a better understanding of the matter.