[Silhouette]

The GDPR isn't a bunch of rules, it's a process.

The GDPR is an EU regulation. An EU regulation is a bunch of rules that have direct legal effect across the Union.

No, you don't. That's covered by the rule "Compliance with a legal obligation" because you have to do it, but only store as much as you need.

That's a legal basis for processing, which you also have to disclose. It doesn't exempt you from disclosing other required information such as the types of personal data you're collecting or your policy on retention.