You know that when a regulation mandates a role like this, it isn't the person's entire job, right? When GDPR says you need a data protection officer, it doesn't mean you need to hire someone to be your data protection officer. In a very small startup, it could mean the CEO is also the data protection officer.

You don't need a whole full timer for that either. When we had to deal with the usual iso stuff it was one guy hired through the agency working on Thursdays