I would assume so, but are you confident that the law unambiguously permits this? This isn't a rhetorical question, as I don't know a ton about the GDPR, but un

I would assume so, but are you confident that the law unambiguously permits this? This isn't a rhetorical question, as I don't know a ton about the GDPR, but uncertainty is one of the worst forms of regulatory costs, so it's not really something you can wave off without knowing how it will be interpreted.