When is processing personal data 'necessary'?

With the exception of the lawful basis of consent, you should only process personal data if it is necessary for the outcome you want to achieve.

To be 'necessary' processing doesn't have to be absolutely essential, but your justification needs to be stronger than because it's a convenient way of achieving your purpose, or because it has always been done in a particular way. Processing is not considered 'necessary' if you can reasonably achieve the same purpose in a less intrusive way.

You need to ensure when processing personal data, it is done in a targeted and proportionate way in order to achieve your purpose.