Skip to main content
Privacy Track
Category: Lawful Basis for Processing

Performance of a Contract

Also known as: Contract Performance, Contractual Necessity (as a lawful basis)
Simply put

In data protection, 'performance of a contract' is one of the recognised reasons an organisation can lawfully use someone's personal data. It generally applies when using the data is genuinely needed to deliver a contract that the individual is a party to, or to take steps the individual has asked for before entering into a contract. Note that the evidence provided here describes contract performance in a general commercial and contract-law sense rather than in the specific data protection context, so the details below should be verified against the current official regulatory text and guidance.

Formal definition

As a general contract-law concept, performance of a contract refers to the fulfilment by the parties of the obligations they undertook in an agreement, to a standard acceptable under the terms and applicable law. In the data protection context it is typically invoked as a lawful basis for processing personal data, which generally requires that the processing be objectively necessary either to perform a contract to which the data subject is a party, or to take pre-contractual steps at the data subject's request. The precise scope, the necessity threshold, and the specific article on which this basis rests should be confirmed against the current GDPR text and regulator guidance, as the evidence supplied does not address the data protection framing; this basis is also distinct from consent and from the other lawful bases, and processing of special category data would require an additional condition beyond a lawful basis. Member state implementing law and UK GDPR positions may vary and should be checked.

Why it matters

Performance of a contract is one of the recognised lawful bases an organisation may rely on to process personal data, and choosing it correctly matters because the lawful basis frames what an organisation can and cannot do with the data. This basis generally applies only where the processing is objectively necessary to deliver a contract to which the individual is a party, or to take pre-contractual steps at that individual's request. Selecting it when it does not genuinely fit, for example, where the processing is merely useful rather than necessary, can leave an organisation without a valid basis and exposed to challenge. The evidence supplied here describes contract performance in a general commercial and contract-law sense rather than in the specific data protection context, so the precise scope and threshold should be verified against the current GDPR text and regulator guidance.

The distinction also matters because relying on contractual necessity is different from relying on consent or the other lawful bases, and it carries different consequences for individuals' rights and for how the organisation must justify its processing. Where the processing involves special category data, an additional condition beyond the lawful basis is generally required. Getting the basis wrong at the outset can undermine an entire processing activity, since the basis typically cannot simply be swapped after the fact.

Because positions can differ between the EU GDPR, the UK GDPR, and national implementing law, and because the necessity threshold has been the subject of regulator guidance, organisations should treat the framing here as a starting point and confirm the applicable article, scope, and interpretation against current official sources rather than relying on a general contract-law description.

Who it's relevant to

Data Protection Officers and Compliance Leads
Those responsible for documenting lawful bases need to assess whether processing is genuinely necessary to perform or enter into a contract, rather than merely convenient, and to distinguish this basis from consent and the other lawful bases. They should verify the applicable article and necessity threshold against current regulator guidance and note that special category data requires an additional condition.
Privacy and Commercial Lawyers
Lawyers advising on contracts and processing activities should recognise that a general contract-law understanding of performance is not the same as the data protection lawful basis, and should confirm the precise scope against the current GDPR and UK GDPR text, taking account of possible divergence in national implementing law.
Engineers and Product Teams
Teams designing systems that collect or use personal data should understand which processing is necessary to deliver a contracted service, since relying on contractual necessity generally limits processing to what the contract objectively requires. Where processing goes beyond that, a different lawful basis may be needed.

Inside Performance of a Contract

Legal basis under Article 6(1)(b)
Performance of a contract is one of the six lawful bases for processing personal data under Article 6(1) of the GDPR. It permits processing that is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.
Necessity requirement
The processing must be objectively necessary to perform the contract, not merely useful, convenient, or referenced in the contract terms. Regulatory guidance generally emphasises that if the contract could reasonably be performed without the specific processing, this basis is typically not available for that processing activity.
Data subject as a party
This basis generally applies where the individual whose data is processed is themselves a party to the contract. It does not typically extend to justify processing the data of third parties who are not party to the agreement, for whom a separate lawful basis would generally be required.
Pre-contractual steps
The basis also covers steps taken at the data subject's request before entering into a contract, such as processing needed to provide a quote or respond to an application initiated by the individual. Steps not requested by the data subject generally fall outside this element.
Interaction with special category data
Where the processing involves special category data under Article 9, performance of a contract as an Article 6 basis is not sufficient on its own; an additional condition under Article 9(2) is generally required to lawfully process such data.

Common questions

Answers to the questions practitioners most commonly ask about Performance of a Contract.

Does relying on performance of a contract mean I can process any data I want as part of delivering my service?
No. This legal basis under Article 6(1)(b) only covers processing that is objectively necessary to perform the specific contract with the data subject, or to take pre-contractual steps at their request. It is not a general permission to process data that is merely useful, convenient, or commercially desirable. Processing that goes beyond what is genuinely necessary to deliver the agreed service typically needs a different Article 6 basis, such as legitimate interests or consent, subject to assessment. The necessity test is interpreted narrowly rather than by reference to what the contract text happens to say.
Is performance of a contract just another way of describing consent that I obtain through my terms and conditions?
No. Performance of a contract and consent are distinct legal bases under Article 6, and they should not be conflated. Bundling processing purposes into terms and conditions and treating acceptance as consent does not convert non-necessary processing into contractual necessity. Where processing is genuinely necessary to perform the contract, you generally rely on Article 6(1)(b) and do not additionally need consent for that processing. Where it is not necessary, presenting it as an unavoidable condition of the contract can undermine the validity of any consent relied upon. The two bases carry different requirements and different data subject rights.
How do we assess whether processing is genuinely necessary for the contract rather than just related to it?
The assessment generally focuses on whether the processing is objectively required to deliver the core service the individual has requested, rather than on whether it is referenced in the contract. A common approach is to identify the substance of what the individual is contracting for, then determine whether a specific processing activity is essential to provide that, or whether the service could reasonably be delivered without it. If a less intrusive way of achieving the same purpose exists, the processing may not meet the necessity threshold and another basis should be considered. This is a context-specific judgement and should be documented.
Can we use performance of a contract as the legal basis when the contract is with an organisation rather than the individual?
This basis applies to a contract to which the data subject is a party, so care is needed where the individual is not the counterparty. For example, processing the personal data of an organisation's employees or contacts under a business-to-business contract is often not covered by Article 6(1)(b) in respect of those individuals, because they are not themselves parties to the contract. In such cases another basis, frequently legitimate interests subject to a balancing assessment, may be more appropriate. The correct analysis depends on who the data subject is relative to the contract.
What should we record in our records of processing and privacy notice when relying on this basis?
It is generally advisable to identify the specific contract or type of contract, the processing activities considered necessary to perform it, and the reasoning supporting that necessity for each activity. Privacy information provided to data subjects should state that performance of a contract is the legal basis and describe the relevant purposes, in line with transparency obligations. Where some activities rely on this basis and others rely on a different one, documenting that split helps demonstrate accountability. Retaining the necessity analysis supports your position if a regulator or data subject queries the basis.
What happens to processing that was based on contractual necessity once the contract ends?
When the contract concludes, the necessity that justified processing under this basis generally falls away for activities that were only required to perform the contract. Continued processing after that point typically needs to be justified on a separate basis, for example a legal obligation to retain certain records, or legitimate interests subject to assessment. Retention periods should be considered in light of this, and data no longer necessary for the original contractual purpose or another lawful purpose should be handled in accordance with storage limitation principles. The position may vary depending on the nature of the ongoing purpose.

Common misconceptions

Consent is always required to process personal data, so a contract basis is not really needed.
Consent is only one of six lawful bases under Article 6(1). Where processing is genuinely necessary to perform a contract with the data subject, performance of a contract is typically the more appropriate basis, and relying on consent unnecessarily can create difficulties because consent must be freely given and revocable.
If processing is mentioned in the contract terms, it is automatically covered by this basis.
The test is objective necessity for performing the contract, not whether an activity is written into the terms. Regulatory guidance generally indicates that including an activity in a contract does not, by itself, make it necessary for performance; activities like certain profiling or marketing often require a different basis such as legitimate interests or consent, subject to assessment.
This basis can justify processing anyone's data connected to the contract.
The basis generally applies to processing the data of the data subject who is a party to the contract. Processing personal data of third parties who are not parties typically requires a separate lawful basis and should be assessed on its own terms.

Best practices

Assess and document the objective necessity of each processing activity against the specific contract, rather than assuming inclusion in the contract terms is sufficient.
Separate out processing activities that are not strictly necessary for performance (such as certain marketing or profiling) and identify an appropriate alternative basis, subject to assessment.
Confirm that the data subject is a party to the contract, and identify a separate lawful basis for any processing of third-party data that is not a party to the agreement.
Where special category data is involved, identify and record an additional Article 9(2) condition, as performance of a contract alone is generally insufficient.
Record the chosen lawful basis clearly in your records of processing and privacy information so it is transparent to data subjects and defensible to regulators.
Periodically review whether the processing remains necessary for the contract, and verify your position against the current official GDPR text and applicable regulatory guidance, noting that national implementations may vary.