All data now collected directly or indirectly that can identify an individual or is linked to an identified individual now needs careful consideration - do you

All data now collected directly or indirectly that can identify an individual or is linked to an identified individual now needs careful consideration - do you have explicit consent to collect and use that data for that specific purpose? How is that data stored? Who has access to that data? Can the individual view it, correct it, delete it? For example your data scientist can't now look at the raw data and decide to feed it into some new machine learning process to identify fraudulent transactions if when the data was collected explicit consent wasn't obtained to do that. Technical people now need to understand what data is 'protected' by GDPR and what consents have been given for the processing of that data. And that for example linking an IP address to a piece of data can suddenly transform it into personal data now protected by GDPR.