It is entirely possible to reach a reasonable level of compliance in a DIY approach, provided that you familiarize yourself with the relevant legal framework. The UK ICO has produced in-depth guidance to help here, which is significantly more digestible than the laws themselves:
ICO Guide to the UK General Data Protection Regulation (UK GDPR)
For a first reading, it is probably appropriate to focus on the summaries and checklists at the top of each section.
You will however notice that GDPR is a lot about principles, and requirements like selecting appropriate compliance measures yourself. On one hand, this means that you have some flexibility in your compliance approach, but it also means also that you can never be sure whether you're actually compliant. But this is also precisely why professional help can be valuable, since compliance professionals probably have a better overview of best practices, state of the art measures, and also potential pitfalls.
In some other answers, I have written basic overviews/checklists to get started with a GDPR compliance effort.
On to your concrete questions:
What is the best strategy to get started with GDPR compliance?
This is ultimately a business decision that you have to make. You have to consider how much compliance is worth to you, both in terms of time and money. Maybe you can DIY it, maybe you'll want to get professional help, maybe you'll just hope that no one ever sues you or lodges a complaint. There is no objective optimum, and only you know your particular situation.
What are the consequences for unintentional infringement?
Not being aware of the rules is not a valid defense (ignorantia juris non excusat).
How are fines calculated?
The GDPR has two separate enforcement mechanisms: data subjects can sue you for compliance and damages, and the ICO can fine you.
Damages are typically small compared to the cost of a lawsuit.
When issuing fines, the ICO must consider a variety of factor per Article 83, for example whether the infringement was willful or negligent. The ICO is not required to impose damages, and anecdotally many small problems can be resolved informally before it comes to a full investigation.
In particular, the ICO's Regulatory Action Policy 2018 explains that “we will reserve our powers [to issue fines] for the most serious cases, representing the most severe breaches of information rights obligations. These will typically involve wilful, deliberate or negligent acts, or repeated breaches of information rights obligations, causing harm or damage to individuals.” The policy also provides a 5-step process for arriving at fines: removing financial gain, accounting for scale and severity of the breach, considering aggravating factors, ensuring a deterrent for others, and considering mitigating factors.
This suggests that a good-faith effort to ensure compliance already goes a long way.
When to get professional help?
Under some circumstances, the GDPR requires that you appoint a data protection officer, who doesn't have to be an employee. You mention that you do not process sensitive data, so that it is currently unlikely you'd be required to appoint a DPO (compare Art 37, but note that the list of sensitive categories of data in Art 9(1) does not match your examples). The requirement to appoint a DPO depends entirely on the kind and scale of your data processing activities, not on number of employees or revenue thresholds. However, some GDPR compliance obligations like Art 30 Records of Processing Activities can also trigger when you reach 250 employees.
Aside from that, it is a business decision whether and when to invest in compliance.
Note that if your business offers goods or services to people in the EU/EEA, you may be required to appoint an EU representative. Some law firms offer package deals for DPOs + EU/UK representatives.
