Absolutely, and gdpr doesn't get in the way of those legal obligations. The point is that you can do what is necessary or expected to provide the service without consent, and you can do much more with consent.