Skip to main content
Privacy Track
Category: Lawful Basis for Processing

Pre-Contractual Steps

Simply put

Pre-contractual steps are things an organisation does before a contract is formally in place, at the request of the person concerned, such as processing their personal data so they can receive a quote or service information ahead of entering into an agreement. In some cases, this processing can rely on the contract lawful basis rather than requiring separate consent. However, this only covers steps taken at the individual's request, not activities the organisation initiates on its own.

Formal definition

Under the contract lawful basis (an Article 6 basis of the UK GDPR and EU GDPR), processing may be lawful where it is necessary to take steps at the request of the data subject prior to entering into a contract. Per ICO and EDPB guidance, the processing must be objectively necessary to take those pre-contractual steps and must be initiated at the request of the data subject; it generally does not apply where an organisation takes such steps on its own initiative, to meet other obligations, or at the request of a third party. Where a less intrusive means of achieving the same purpose exists, the processing may not be regarded as 'necessary' for this basis. This basis is distinct from consent, and processing of special category data would still require an additional Article 9 condition. Practitioners should verify the current official text and applicable regulator guidance, as interpretation of 'necessity' continues to be shaped by guidance.

Why it matters

The contract lawful basis is often reached for when an organisation interacts with a prospective customer, but the pre-contractual steps limb is narrower than it first appears. It applies only where the individual has asked the organisation to do something before a contract is formed, such as requesting a quote or service information. Organisations that treat this basis as a general permission to process data during marketing, prospecting, or onboarding activities they themselves initiate risk relying on the wrong lawful basis, which can undermine the overall lawfulness of the processing.

According to ICO guidance, the basis does not apply where an organisation takes pre-contractual steps on its own initiative, to meet other obligations, or at the request of a third party. This boundary matters because misclassifying self-initiated processing as a pre-contractual step can leave a gap: the organisation may believe it has a lawful basis when it does not, and may have skipped the consent or legitimate interests analysis that the activity actually required. Getting the basis right at the outset also affects downstream obligations, including the information provided to individuals and their applicable rights.

The necessity test adds a further constraint. As reflected in EDPB and related guidance, the processing must be objectively necessary to take the requested steps, and where a less intrusive means of achieving the same purpose exists, the processing may not be regarded as necessary for this basis. Because interpretation of necessity continues to be shaped by regulator guidance, organisations should document their reasoning and verify their position against the current official text rather than assuming a fixed answer.

Who it's relevant to

Data Protection Officers and Privacy Leads
DPOs and privacy leads need to distinguish genuine pre-contractual steps taken at the individual's request from self-initiated activities that require a different lawful basis. This affects lawful basis mapping, records of processing, and the information provided to individuals, so accurate classification at the design stage helps avoid downstream compliance gaps.
Sales, Marketing, and Onboarding Teams
Teams that handle quotes, enquiries, and prospect onboarding should understand that responding to a customer's own request may fall within this basis, but proactively initiated outreach or prospecting generally does not. Recognising this boundary helps them escalate ambiguous activities for a lawful basis assessment rather than assuming the contract basis applies.
Compliance and Legal Advisers
Advisers assessing whether processing is 'necessary' for pre-contractual steps should evaluate whether a less intrusive means could achieve the same purpose and document the reasoning. Because interpretation of necessity continues to be shaped by ICO and EDPB guidance, they should verify positions against current official text and note any divergence between regulators.
Product and Engineering Teams
Teams building quoting tools, sign-up flows, and enquiry forms should design data collection so that only data objectively necessary for the requested step is processed, supporting the necessity test and reducing reliance on collecting more data than the pre-contractual step requires.

Inside Pre-Contractual Steps

Article 6(1)(b) contractual necessity basis
The legal basis under Article 6(1)(b) GDPR that permits processing where it is necessary either for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract. Pre-contractual steps fall within the second limb of this basis.
Request of the data subject
A defining requirement of the pre-contractual limb: the steps must be taken at the initiative or request of the individual, not unilaterally by the controller. Processing that the controller drives for its own purposes, such as unsolicited marketing, generally does not qualify and typically requires a different Article 6 basis.
Necessity test
Processing must be genuinely necessary to take the requested pre-contractual steps, not merely useful or convenient. Regulatory guidance (notably from the European Data Protection Board) indicates necessity should be assessed against whether a less intrusive means could achieve the same purpose.
Typical qualifying activities
Examples commonly cited include providing a quote, conducting a service feasibility check, or processing an application that the individual has initiated. The specific activities that qualify depend on the facts and should be assessed case by case.
Relationship to special category data
Where pre-contractual steps involve special category data under Article 9, the Article 6(1)(b) basis alone is insufficient; an additional Article 9 condition must also be identified and satisfied.

Common questions

Answers to the questions practitioners most commonly ask about Pre-Contractual Steps.

Does relying on 'pre-contractual steps' require obtaining the individual's consent?
No. Pre-contractual steps sit under the contract legal basis in Article 6(1)(b), which is a distinct legal basis from consent under Article 6(1)(a). Where processing is necessary to take steps at the data subject's request prior to entering into a contract, you generally do not also need consent, and treating consent as a universal requirement here is a common misconception. Note that special category data under Article 9 would still require a separate Article 9 condition, and the position may be subject to assessment in the particular context.
Can I treat any processing that happens before a contract is signed as covered by the pre-contractual steps basis?
Not necessarily. The basis typically applies where the steps are taken at the request of the data subject and are necessary to move toward a contract. Processing you initiate on your own account, or that is not genuinely necessary to the prospective contract, generally falls outside this ground and may need a different Article 6 basis such as legitimate interests, subject to assessment. The boundary turns on necessity and on whose request prompted the processing.
How should I document that processing qualifies as a pre-contractual step?
In most cases you would record which Article 6 basis you are relying on, the nature of the data subject's request that triggered the processing, and why the specific processing is necessary to take those steps. Keeping this in your records of processing activities and internal assessments helps demonstrate accountability. You should verify the exact documentation expectations against current regulatory guidance, as expectations can evolve.
What should a privacy notice say when processing is based on pre-contractual steps?
A transparency notice would typically identify the contract basis under Article 6(1)(b) and explain that the processing is to take steps at the individual's request before entering a contract, alongside the usual information required by transparency provisions. Where the necessity is context specific, describing the purpose clearly helps the individual understand the boundary of the processing. Confirm the specific content requirements against the applicable transparency articles.
How does the pre-contractual steps basis interact with the right to erasure or objection?
Because this basis is not consent, the mechanics differ: the right to object under Article 21 generally does not apply to processing based on Article 6(1)(b), and data portability may be relevant since it can attach to contract-based processing carried out by automated means. Erasure rights still apply in the circumstances set out in the Regulation. The precise availability of each right is context dependent and should be assessed against the current text and guidance.
What happens to data processed for pre-contractual steps if the contract is never concluded?
Once the prospective contract does not proceed, the necessity that justified the processing may no longer exist, so you generally reassess whether continued retention is lawful and consider deletion or a different legal basis for any onward use. Retention should typically align with your retention schedule and storage limitation principles. Because this depends on the specifics and on any national or sectoral requirements, treat the decision as subject to assessment rather than fixed.

Common misconceptions

Any processing before a contract is signed automatically falls under Article 6(1)(b).
The pre-contractual limb applies only to steps taken at the data subject's request and only where processing is necessary for those steps. Controller-initiated activities, such as profiling prospects or unsolicited outreach, generally do not qualify and typically require another basis, such as consent or legitimate interests, subject to assessment.
Consent is always needed to process data during the pre-contractual phase.
Consent is one of several distinct Article 6 bases and is not a universal requirement. Where the necessity and request conditions are met, Article 6(1)(b) can apply without separate consent. Consent may still be relevant for particular activities or where an additional Article 9 condition is required for special category data.
If a contract is ultimately not concluded, the pre-contractual basis was invalid.
The lawfulness of the basis is generally assessed at the time of processing against whether the steps were necessary and requested, not by whether a contract eventually results. That said, retention beyond the pre-contractual purpose should be reassessed against storage limitation and other principles.

Best practices

Confirm and document that the pre-contractual steps were initiated at the data subject's request before relying on Article 6(1)(b), and record what the requested steps were.
Apply a necessity test to each processing activity, considering whether a less intrusive means could achieve the same pre-contractual purpose, and retain that reasoning.
Do not default to Article 6(1)(b) for controller-driven activities such as marketing or profiling; assess whether consent, legitimate interests, or another basis is more appropriate.
Where special category data is involved, identify and document a separate Article 9 condition in addition to the Article 6 basis.
Reassess the basis and retention once the pre-contractual phase ends, since a basis valid at the time of the requested steps may not justify continued processing.
Verify your position against current EDPB guidance and, where relevant, applicable UK GDPR or national implementing law, noting that member state derogations may vary the outcome.