@jonathan IANAL, but you might blowing #GDPR out of proportion.

> I was more thinking about unavoidable data collection from the process of doing business with someone like a enquiry form still needs a name and email address.

This is probably a legitimate collection/use of data, but keep that shit secure, don't sell it or share it without the other person's explicit and informed consent, and delete it once the business transaction is complete. #CRMisEVIL