No, you don't have to. > At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds

No, you don't have to. > At the very least there are additional record keeping steps, policies and procedures to draft, the appointment of a DPO that responds to requests for access or erasure, and the development of the features to fulfill both of those requests. * "Record keeping steps" are not needed if you don't keep records (which is what you should do); * "Policies and procedures" are what you should already have, of course, and GDPR didn't change that in any way; * A DPO must be appointed only if processing the personal data of your customers is your core activity; * Developing features to fulfill requests for access or erasure isn't necessary if you don't keep records.