Worrying about GDPR? I wrote a step-by-step guide specifically for startups and small business

I honestly believe most of it is very appropriate and is just you doing the right thing for your users, and as a small business you get to skip a lot of the harder work like auditability (that's only for organizations of 250 or more people). However, I definitely think for small business the burden is a bit too much of having to provide Data Processing Agreements if you're a Data Processor, and of having to sign such agreements with any sub-processors and keep Data Controllers informed when you add new sub-processors.

You'll probably find you're in good shape if this has already been your focus. It's still a good exercise to go through all the different ways you process data and all the different 3rd parties you use to process data, and see if things can be made simpler and more private.