The GDPR means you need a lawful basis for processing the data. Not that you can't process it at all. There's lots of talk about consent as a basis for process

The GDPR means you need a lawful basis for processing the data. Not that you can't process it at all. There's lots of talk about consent as a basis for processing. For lots of purposes "Legitimate Interests" is likely a better basis. You'll have to perform a legitimate interests assessment and be able to justify that the potential negative impact of your processing is outweighed by the benefits. The ICO has a interactive tool for selecting a basis for processing https://ico.org.uk/for-organisations/resources-and-support/lawful-basis-interactive-guidance-tool/ https://ico.org.uk/for-organisations/resources-and-support/l... with links to more information.