[termsfeed]

You can start with a review of what kind of personal data you collect, if data is only "personal data" or it includes "sensitive personal data".

Then, consider how to get consent from users. A passive way of getting consent would not work under GDPR. You can look at the examples with those "I agree with..." type of checkbox (also called clickwrap) for inspiration how to get consent.

Then, take in consideration the user rights under GDPR and how you'll help users in this matter: right to update data, right to delete data, right to data portability and so on:

https://gdpr-info.eu/chapter-3/

We've released a small presentation on SlideShare titled "GPDR Compliance Plan" that might useful:

https://www.slideshare.net/termsfeed/gdpr-compliance-plan