[GRBLDeveloped]

You can use Paddle as your payment provider and it will handle VAT for you.

For a small business I would imagine GDPR is pretty much just have a straight forward privacy policy that states your intentions with someone's data. If someone requests their data then send it to them, if they want it deleted then do. I think that GDPR likely doesn't come up for the majority of small business besides a data consent pop up on a homepage.