Sure, GDPR isn't applicable against law enforcement, but it is a surprisingly strong public right. TM and robocalls? It didn't take long for all of that to cease after I simply started to ask for the name and contact information to the consumer privacy manager for the caller's employer and then whispering "GDPR" whenever I got an unsolicited phone call.

Ideally, an off-the-shelf machine (maybe from a few select hardware vendors/partners) with a very straightforward setup process, or an optional pre-installation.

I see data integrity as a key risk to address, though. Maybe something with a built-in Li-Ion battery (kept at 50% charge for longevity) that can keep running and safely shutdown in the event of a power blip, and an easy way to sync to rotating backups (i.e. plug in an external HDD once a week, or sync directly to another machine across the internet, no cloud in the middle). But IMO for most SMB-size work, RAIDs are overrated in the era of SSDs and modern filesystems.