You're only talking about the technial part. But there are non technical requirements as well: In many cases you need to name a person responsible for data prot

You're only talking about the technial part. But there are non technical requirements as well: In many cases you need to name a person responsible for data protection, a privacy policy, a list of services you're sharing data with,... Though I'm not sure if a local US newspaper even needs to be compliant, since it doesn't target EU residents and thus might be out of scope.