What is "Contractual Necessity" under the GDPR?

Contractual Necessity

Key points: (1) The contractual necessity lawful basis may be relied upon when processing is necessary to perform a contract with the individual or to take pre-contractual steps at the individual's request, such as providing a quote. (3) Processing must be objectively necessary for the contractual purpose. If the same result can reasonably be achieved by processing less personal data or by using less intrusive means, this lawful basis does not apply. (4) Controllers should document their assessment and be able to demonstrate why the processing is necessary for the performance of the contract or the requested pre-contractual steps.

When can you rely on the contractual necessity lawful basis?

The contractual necessity lawful basis applies in two situations:

• Performance of a contract. The controller has a contract with the individual, and processing the individual's personal data is necessary to perform the contract or comply with the controller's contractual obligations.
• Pre-contractual steps requested by the individual. No contract has yet been formed, but the individual has asked the controller to take specific steps before entering into a contract (for example, providing a quotation or responding to a service request), and processing is necessary to fulfill that request.

The contractual necessity lawful base is available where:

• The controller has a contract with the individual and the processing is necessary to comply with the controllers obligations under the contract.
• The controller does not have a contract with the individual, but the individual asked the controller to do something as a first step (e.g. provide a quote) and the processing is required to do what the individual asked.

This lawful basis does not apply where:

• The contract is with someone other than the individual whose data is being processed.
• The controller processes personal data for its own independent business purposes, even if the contract permits such processing or it forms part of the controller's commercial or funding model.
• The processing goes beyond what is objectively necessary to perform the contract or take the requested pre-contractual steps.
• The controller takes pre-contractual steps on its own initiative, rather than at the request of the individual.
• The processing is carried out to comply with separate legal, regulatory, or contractual obligations unrelated to the performance of the contract with the individual.
• The controller acts at the request of a third party, rather than at the request of the individual whose personal data is being processed.

Example: An individual requests a quote for car insurance. To prepare the quotation, the insurer must process information such as the vehicle's make, model, age, and, where financing is involved, the applicant's credit information. Because the individual requested the quotation, this processing is necessary to take pre-contractual steps at the individual's request.

If processing of special category data is necessary for the contract, you also need to identify a separate condition for processing this data. 

What qualifies as a contract?

For purposes of this lawful basis, a contract does not need to be a formal written agreement or a signed document. An agreement may be sufficient, provided it satisfies the requirements of applicable contract law.

Although the specific rules vary by jurisdiction, a valid contract generally requires:

• An offer and acceptance of the contractual terms;
• An intention by the parties to create legally binding obligations; and
• An exchange of value (commonly goods or services in exchange for payment, although other forms of consideration may also suffice).

Whether a valid contract exists ultimately depends on the applicable law. Where there is uncertainty, controllers should seek legal advice before relying on contractual necessity as their lawful basis for processing.

Where the contract is entered into by a child, controllers should determine whether the child has legal capacity to contract under the applicable national law. The rules governing contractual capacity differ among EU Member States.

What does "necessary" mean?

The term "necessary" does not mean that processing must be absolutely indispensable. However, the processing must be objectively necessary, targeted, and proportionate to perform the contract or to take the specific pre-contractual steps requested by the individual.

This lawful basis cannot be relied upon if the same contractual purpose can reasonably be achieved through less intrusive processing.

Importantly, the fact that certain processing is useful, commercially beneficial, or convenient does not make it necessary for contractual performance. If processing is not necessary for the contract, the controller may still carry it out—but only if another lawful basis under the GDPR applies.

Example: When an individual purchases goods online, the seller processes the customer's delivery address to ship the order. This processing is necessary to perform the sales contract.

Example: By contrast, creating a profile of the customer's interests and preferences based on previous purchases for personalized advertising is generally not necessary to perform the contract. Although personalized advertising may support the controller's business model or enhance the customer relationship, European data protection authorities have consistently taken the position that such processing requires a different lawful basis, such as consent or legitimate interests, rather than contractual necessity.

Further Reading

The EDPB has adopted final guidelines on processing under Article 6(1)(b) in the context of online services.