I don't know, I don't make the rules...

But for now, I'm going to stay on the safer side, write my policy, and hopefully avoid GDPR fines.