GDPR

I'm new here, so I apologize if I'm not clear on where or how to ask my question.

My question is about GDPR rules, and I found a helpful resource at https://gdpr-text.com/.

I'm curious about how your company applies these rules. For instance, if you use a CRM system, you likely store personal data about your customers. In my case, we don't have patient data, but we do have information about doctors in hospitals, which we use for communication. Our business conditions include a GDPR section outlining the types of data we store. Do you send consent emails to your customers?

My question is: How does your company manage GDPR compliance with regards to emails and CRM systems? GDPR suggests periodically deleting emails to reduce data risks, but sometimes you need to keep records, as required by ISO 13485, for example, to provide evidence of events or existence.