IANAL but I think the GDPR does not just look at the data in isolation, but considers the data and what it is used for. Thus if I give a company access to my d

IANAL but I think the GDPR does not just look at the data in isolation, but considers the data and what it is used for. Thus if I give a company access to my data it does not give them a carte blanche to use it however they see fit, instead I have allowed usage of the data for a set of purposes.