Contracts

Data processing under contractual agreements is another lawful basis under the GDPR:

• Contractual Necessity: Organisations can process personal data when it is necessary for the performance of a contract with the data subject. This includes situations where data processing is required to fulfil obligations under a contract or to take pre-contractual steps at the data subject's request.

Clear Purpose: Data processing should be limited to what is necessary for fulfilling the contract. Ensure that data subjects are aware of how their data will be used in the context of the contract.