Consider lawful basis. Does your processing fall under the lawful basis you think it does? Who the hell knows. Making an educated guess as to what the regulators and courts will think is legal scholarship, one of the most expensive professional services money can buy. And even if you get billed for hundreds of hours of the most premium legal minds thinking about it they can still be wrong.
Words like “reasonable” and “legitimate” in the law are not something it is safe for a layperson to reason about. They have specific meanings depending on the nuances of case law, judicial understanding of legislative intent, ideological leanings of the judge you happen to draw, etc.
No company is competent at this, some just have enough money at stake and enough to spend on lawyers that they’re willing to risk it.
Words like “reasonable” and “legitimate” in the law are not something it is safe for a layperson to reason about. They have specific meanings depending on the nuances of case law, judicial understanding of legislative intent, ideological leanings of the judge you happen to draw, etc.
No company is competent at this, some just have enough money at stake and enough to spend on lawyers that they’re willing to risk it.