But that applies to pretty much any new law: you need to consider what it means for your existing process. I can't ignore tax law with "but that was different l

But that applies to pretty much any new law: you need to consider what it means for your existing process. I can't ignore tax law with "but that was different last year!" either. Even keeping records about applicants for a long time without explicit permission is a problem, so if you still have pre-GDPR records around... GDPR was published 2016 and became active in 2018. Even if you only started to think about it at the second date you've had almost 4 years.