Under GDPR, companies must have a legal basis to process personal data. Processing personal data without a basis specified in law is illegal. One of those legal

Under GDPR, companies must have a legal basis to process personal data. Processing personal data without a basis specified in law is illegal. One of those legal bases is that processing personal data is "necessary for the purposes of the legitimate interests pursued by the [company]". For companies that chose this as their legal basis, they must conduct a balancing test between the benefits provided by the processing and potential impact to individuals whose data is processed. If you don't do that balancing according to the whims of the data protection authority, your data processing will be a violation of GDPR. If you don't have documentation of that balancing, the authority will presume you did not do any balancing, and therefore your data processing violates GDPR.