Article 6(1)(b) of the GDPR

The European Data Protection Board has adopted final Guidelines on the processing of personal data using the “necessary perform a contract” lawful basis under Article 6(1)(b) of the GDPR, in the context of the provision of online services.

Article 6(1)(b) of the GDPR provides a lawful basis for the processing of personal data to the extent that the processing is:

  • Necessary for the performance of a contract to which the data subject is a party; or
  • In order to take steps at the request of the data subject prior to entering into a contract.

The Guidelines outline the elements of lawful processing under Article 6(1)(b) and focus in particular on the concept of ‘necessity’. They begin by examining the interaction between this lawful basis and other obligations under the GDPR.
Continue Reading When is it ‘Necessary’ to Process Personal Data to Perform a Contract?