This sounds like a "legitimate interest"[1] and/or "legal obligation"[2], which is a lawful basis for processing personal data under the GDPR, even without expl

This sounds like a "legitimate interest"[1] and/or "legal obligation"[2], which is a lawful basis for processing personal data under the GDPR, even without explicit consent. Explicit consent only enters into the picture when no other lawful basis for processing personal data exists. You can find a full list of lawful bases at [3]. [1]: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [2]: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legal-obligation/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [3]: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-data-protectio...