SMEs should be clear and open from the outset about proposed processing of personal data. Learn more about purpose limitation:

https://arc-rec-project.eu/wp-content/uploads/2021/01/ARC-GUIDANCE-Quick-Guide-to-the-Principles-of-Data.pdf