You do have to get specific permission to use data for a specific purpose under the GDPR. For instance, there are approved forms to ask customers for permission to add them to a mailing list. In that case, whether or not the company has the data stored somewhere is immaterial if it does not have the correct permission to use it for mailing.