If you are not using any of the data you have access to, that makes compliance very easy. Where you share data with third parties (such as by making HTTP requests) that is already a bit more complicated. Who runs that endpoint? Under what legal basis can you send them data? Does this count as an international transfer? What will they do with personal data? How do you protect the connection, e.g. by using HTTPS?
In practice this is still fairly simple, but compliance is not zero effort.