What data you're actually collecting
Name, contact info, fiscal data and project documents are enough for most small businesses. You don't need to collect more "just to be thorough", minimal collection is a core GDPR rule.
Who sees what, in the portal
A client sees only their own data, strictly isolated from the data of the company's other clients. That isolation isn't just good practice, it's a basic compliance requirement.
What to do on a deletion request
GDPR requires that you be able to delete or export a client's data on request, within a reasonable timeframe. A system where data is centralized, not scattered, makes this feasible, not a weeks-long project.
Bottom line
GDPR doesn't mean less functionality for the client, it means clear rules about who sees what and how easily you can respond to a legitimate request.