In principle you need to have records of your risk assessment(s) and you need to have good T&Cs (like for GDPR, etc). But that's about it for red tape.

Templates have popped up to help with both.