You need to be GDPR-compliant, but you don’t need to automate GDPR compliance yet.
You have 30 days to comply with e.g. right to deletion requests. That’s easily long enough to write backend code to delete someone’s data. So don’t write that code until someone requests that you delete their data (unless you need to write it before then for other reasons, ofc).
