Is the GDPR only relevant for personal data?

Yes, but that concept is broader than people think: even an email address or IP address counts.

Do we have to arrange everything ourselves?

Part is organisational and lies with you, part is technical and we build it in. We make clear up front what lies where.

What if we already have software that does not comply?

Then we look at what can be solved with limited changes. Not everything has to be redone.

GDPR and software: what should you look out for?

The GDPR is often seen as a formality after the fact. In practice it is mainly a design choice: what you arrange well up front, you do not have to patch together later with duct tape.

Collect only what you really need

The most powerful principle is also the simplest: data you do not collect, you do not have to secure, store or delete. For every field in a form you may ask whether you really need it.

Know why you keep something

For every kind of data there should be a reason and a retention period. That sounds formal, but it prevents the situation where nobody knows why certain data is there and whether it may go.

Security is not an afterthought

Limit access to those who really need it.
Store and transmit data encrypted.
Keep track of who has seen or changed what and when.

Building these things in during the design costs little extra. Adding them afterwards is almost always more expensive and messier.

Mind where your data is

Where your data is physically located and which parties can access it is part of your responsibility. Ask this of every supplier, including handy tools you quickly add.

In short

Collect less, know why you keep something, build in security from the start and know where your data is. Then the GDPR is not a brake, but simply good craftsmanship.