You need the customer&#x27;s consent. So if they opt-in it&#x27;s alright in most cases. But you can only store their personal data if you absolutely need to, and in a secure way. For example only store post address if you intend to send them snail male.<p>You can for example only have someone in your CRM if they are a customer. And if they ask you to remove their data, you must remove all information about them.<p>You do not have to worry if your company and all your equipment is located outside Sweden though. But as for example Facebook have a data-center in Sweden, you can actually request them to remove all your data.<p>Example of illegal database is a database for direct marketing. Or a register of race, religion or preferences.