I hold a certification in information privacy, so my totally-biased answer is "hire an expert!" :p The reading/writing requirements are from PECR, which is old

I hold a certification in information privacy, so my totally-biased answer is "hire an expert!" :p The reading/writing requirements are from PECR, which is old and dumb. Passed in 2003ish, and was basically ignorable until GDPR changed the definition of consent. Updating it to include GDPR's much-saner concept of "Legitimate Interest" has been a priority goal for several years, but never actually happens.