Introduction Since GDPR entered into force a lot has been said and written about the way organisations can collect and then process personal data they have. In my opinion though, not much attention has been devoted to re-using personal data that already are in companies’ databases. Under the GDPR any processing of personal data is possible subject to fulfilment of