Contract

At a glance

• You can rely on this lawful basis if you need to process someone’s personal data:
  • to deliver a contractual service to them; or
  • because they have asked you to do something before entering into a contract (eg provide a quote).
• The processing must be necessary. If you could reasonably do what they want by processing less data, or using their data in a less intrusive way, this basis will not apply.
• You should document your decision to rely on this lawful basis and ensure that you can justify your reasoning.

In brief

• When is the lawful basis for contracts likely to apply?
• When is processing ‘necessary’ for a contract?
• What else should we consider?

When is the lawful basis for contracts likely to apply?

You have a lawful basis for processing if: 

• you have a contract with the individual and you need to process their personal data to comply with your obligations under the contract.
• you have a contract with the individual and you need to process their personal data so that they can comply with specific counter-obligations under the contract (eg you are processing payment details).
• you haven’t yet got a contract with the individual, but they have asked you to do something as a first step (eg provide a quote) and you need to process their personal data to do what they ask. This applies even if they don’t actually go on to enter into a contract with you, as long as the processing was in the context of a potential contract with that individual. 

It does not apply if you need to process one person’s details but the contract is with someone else. 

It does not apply if you collect and reuse your customer’s data for your own business purposes, even if this is permitted under your standard contractual terms and is part of your funding model. 

It does not apply if you take pre-contractual steps on your own initiative, to meet other obligations, or at the request of a third party. 

Note that, in this context, a contract does not have to be a formal signed document, or even written down, as long as there is an agreement which meets the requirements of contract law. Broadly speaking, this means that the terms have been offered and accepted, you both intend them to be legally binding, and there is an element of exchange (usually an exchange of goods or services for money, but this can be anything of value). However, this is not a full explanation of contract law, and if in doubt you should seek your own legal advice. 

When is processing ‘necessary’ for a contract?

‘Necessary’ does not mean that the processing must be absolutely essential or ‘the only way’ to perform the contract or take relevant pre-contractual steps. However, it must be more than just useful, and more than just part of your standard terms. It must be a targeted and proportionate step which is integral to delivering the contractual service or taking the requested action. This lawful basis does not apply if there are other reasonable and less intrusive ways to deliver the contractual service or take the steps requested.

The processing must be necessary to perform the contract with this particular person. If the processing is instead necessary to maintain your business model more generally, or is included in your terms for other business purposes beyond delivering the contractual service, this lawful basis will not apply and you should consider another lawful basis, such as legitimate interests.

This does not mean that processing which is not necessary for the contract is automatically unlawful, but rather that you need to look for a different lawful basis (and other safeguards such as the right to object may come into play).

What else should we consider?

If the processing is necessary for a contract with the individual, processing is lawful on this basis and you do not need to get separate consent. 

If processing of special category data is necessary for the contract, you also need to identify a separate condition for processing this data. Read our guidance on special category data for more information. 

If the contract is with a child under 18, you need to consider whether they have the necessary competence to enter into a contract. If you have doubts about their competence, you may wish to consider an alternative basis such as legitimate interests, which can help you to demonstrate that the child’s rights and interests are properly considered and protected. Read our guidance on children and the GDPR for more information. 

If the processing is not necessary for the contract, you need to consider another lawful basis such as legitimate interests or consent. Note that if you want to rely on consent you will not generally be able to make the processing a condition of the contract. Read our guidance on consent for more information. 

If you are processing on the basis of contract, the individual’s right to object and right not to be subject to a decision based solely on automated processing will not apply. However, the individual will have a right to data portability. Read our guidance on individual rights for more information. 

Remember to document your decision that processing is necessary for the contract, and include information about your purposes and lawful basis in your privacy notice.