Short answer: explain what personal data you collect, obtain consent for non-essential tracking, appoint a privacy lead, and document data flows to vendors.