Although a permission process is not required by the GDPR, careful documentation of exactly what permission was requested and authorized is important.
Since new sources of data or uses of that data may require that a new permission is obtained, this task and its subtasks show an example of how that might be set up.