Agree with you. My only addition is to remember to read PECR (https://ico.org.uk/for-organisations/direct-marketing-and-pr...) alongside GDPR.