It's not just business necrssary, it's also mandatory to do rigjt under gdpr