If he's already handling the data securely and only keeping the data necessary for the service (which I doubt but we'll never know) all he has to do is: - Appo

If he's already handling the data securely and only keeping the data necessary for the service (which I doubt but we'll never know) all he has to do is: - Appoint a data protection officer (himself) - Write down the processes of how he stores data (we keep it on this database, hosted at x provider; that provider is called the data processor) and how he deletes data whenever the subject of the data requires it. That's it.