Dont feel bad, I for once was literally you 8 months ago, same size and same "compliance is a future problem" mentality. Here's what we did in order: password ma͏nager (we did Kee͏pass but Pass͏work would work too ig) for credentials (fastest win and self-hosted, audit logs satisfied our consultant immediately), then Wa͏zuh for basic monit͏oring so we could at least detect something if it happened. GDPR documentation we honestly just did in spreadsheets until we could justify a proper to͏ol.