Under GDPR, if you process personal data, you are required to have a clear scope: which data, why, for how long is it retained, under which legal basis (article

Under GDPR, if you process personal data, you are required to have a clear scope: which data, why, for how long is it retained, under which legal basis (articles 5 and 6), etc. Selling data later would be a misappropriation of legal basis. More info here: https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/principles-gdpr/purpose-data-processing/can-we-use-data-another-purpose_en https://commission.europa.eu/law/law-topic/data-protection/r...