This is a good start. I wouldn't worry too much about GDPR compliance starting out. Follow this advice and when customers start asking questions about your comp

This is a good start. I wouldn't worry too much about GDPR compliance starting out. Follow this advice and when customers start asking questions about your compliance, you can invest in a more robust ISMS.