how do I demonstrate that I comply with the GDPR without an expensive certificate

Yes, with documents and demonstrable practices instead of a certificate

An ISO certificate is not a legal requirement under the GDPR and its absence does not mean that a company does not comply with the GDPR. What the GDPR does require is the so-called accountability principle: an organization must be able to demonstrate that it complies with the principles of the regulation, not that it holds a certification mark. In practice, this is demonstrated through a combination of documents, documented agreements and organized processes: a current processing record, signed data processor agreements with suppliers, a privacy notice, and evidence that risks have been considered for new processing activities.

In practice, this usually amounts to a file that grows with business operations, rather than a single certification mark that you achieve once. Consider the question what must be included in a processing register and, for a freelancer, whether maintaining a processing record is also required. A good answer to a client's privacy questionnaire or to what a tender asks about privacy also counts as demonstrating accountability: an organization that can answer that kind of question with concrete documents demonstrates more in practice than a certificate on the wall.

Where this comes from: Article 5 and Article 28 GDPR

The accountability principle is laid out in Article 5 of the GDPR, which sets out the principles of the regulation and explicitly requires that the controller must be able to demonstrate compliance with those principles. Article 28 of the GDPR also governs the arrangements that must be made with processors, and these arrangements themselves form part of the evidence. What a supervisory authority will concretely want to see during an inspection is therefore not a certificate but rather this kind of documentation — see also what you can show if the Dutch Data Protection Authority comes to inspect. These obligations apply directly throughout the EU; anyone wondering how they will be assessed against them falls under the supervisory authority of the country where they are established — in the Netherlands this is the Dutch Data Protection Authority, in other Member States the national supervisory authority there.