> So everything should be written out explicitly, because you'd rather complete a checkbox-ticking exercise rather than thinking about it and do the correct, ethical thing in good faith?

Yes, because if I’m supposed to comply with something, I want to know exactly what I’m complying with.

Right now I think I’m already doing everything in good faith, but the enforces of the GDPR may think different.

This is why we have laws- so we can be held accountable exactly.