That's a good question - as with all things GDPR, who really know, but there seems to be a body of opinion that it clear applies. See https://www.lexology.com/library/detail.aspx?g=7e179bfb-a867-49c0-840e-2e345b9f8ee7 or consider the situation where an employee leaves the company, and implicitly withdraws consent.