The short answer
You can do part of making a new website or webshop GDPR-compliant yourself: draw up a privacy statement, configure cookies correctly and check what data you actually collect. These are steps that mainly require overview and discipline, not legal training. Another part becomes harder to oversee on your own: assessing data processing agreements with your hosting provider, payment provider or analytics tool, and determining whether a particular connection between tools requires extra attention.
The line therefore does not lie between "can I do this myself" versus "do I need to call a lawyer", but rather in the question of how many parties are looking at your data and how sensitive that data is. A simple brochure website with a contact form is easier to oversee than a webshop with customer accounts, payment data and marketing tools linked to each other.
What you can usually arrange yourself
For most businesses, the basis of a privacy statement can be prepared yourself, especially with a good starting point. It states who you are, what data you collect, why, and how long you keep it. That is not creative work but a matter of describing your own practices accurately. The same applies to the cookie banner: if you know what cookies your website places and what they are for, setting up consent is a technical step you can handle yourself or with your website builder.
You can also prepare an overview of the data you collect via forms, accounts or an ordering process yourself. By the way, this overview is not only useful for your website: it is exactly the kind of information that also goes into a processing register. Once you have that overview, you do not need to create it again when another sales moment comes along, such as a customer asking for a data processing agreement or an insurer asking how you handle data.
Where it becomes more complicated
As soon as your website or webshop passes data to other parties, such as a hosting company, an email marketing tool, a payment provider or an analytics service, a data processing relationship arises. The GDPR expects that relationship to be documented in a data processing agreement. Many of those parties have a standard agreement ready, but that does not mean you can sign it without looking. The question is always: what may this party do with the data, where is it stored, and what happens if there is a data breach at that party.
This is the point where doing it yourself becomes less self-evident. Not because it has to be complicated, but because the overview quickly becomes larger than one webshop: most businesses use ten to twenty SaaS tools at the same time, and every tool that processes personal data in principle requires its own check. the knowledge base where this has been worked out per situation provides the short answer per topic and the reference in the legal text, so you can judge yourself whether an agreement is sufficient or whether something is missing.
Security is a different issue than the text on your site
In addition to the text on your website, the technology behind it also plays a role: is the connection secure, are passwords and customer data stored properly, and who has access to managing the webshop. These are not legal questions but practical ones, and they are part of the overall picture. On the page on securing privacy and data you can read where these kinds of questions come from and why supervisory authorities always look at them in the event of a data breach.
When do you call in someone else
There is no hard dividing line between handling things yourself and outsourcing. For a simple website with a contact form, managing it yourself is often sufficient, provided you keep track of what you have and keep it current. With an online shop that has customer accounts, multiple marketing tools, and international suppliers, it becomes harder to maintain an overview, and that is precisely where many businesses choose to have the process monitored rather than manage it manually.
Whether you continue to do that yourself or place it elsewhere is up to you; the law prescribes no method, only a result. If you are uncertain about your own situation, that is a question for a legal advisor or the supervisory authority, not something a system can decide for you.
Work out how it applies to your situation yourself
Many businesses start by asking whether they need to do anything at all, and that question is often quicker to answer than expected. Look at the frequently asked questions about what is and is not necessary or do the free check to see where your website or online shop currently stands. If you subsequently want to know how the system behind gdpria.eu keeps that overview current for you, you can read that on the page that shows where the information comes from.
The knowledge base and the initial check are free, even without an account. If you want the overview of your tools and agreements to stay current automatically, take a look at what is needed for that.