GDPR: When do we process personal data on the basis of a contract?

Čo v článku nájdete:

• A brief note on performing contractual obligations
• How to process personal data on the legal basis of contractual obligations
• Final recommendations

This means that consent to process personal data is not required if a business has entered into a contract with an individual in the course of its business and needs to process personal data to perform that contract.

A brief note on performing contractual obligations

Processing necessary to perform a contract or during pre-contractual relations usually arises when entering into an employment contract or agreement, concluding a contract through an e-shop, making an online booking, and similar situations.

Practice shows that businesses often make mistakes and do not properly understand the difference between legal bases—consent and the other bases. Although they do not need consent to process personal data when performing contractual obligations, they request it.

How to process personal data on the legal basis of contractual obligations

First, it is necessary to define the purpose, or multiple purposes, of processing personal data correctly. If a business has several types of contracts with data subjects, we recommend defining the purposes separately for each contract.

This may be the case where a business operates both an e-shop and a physical shop and requires identification details from data subjects when they make a purchase.

When purchasing through an e-shop, it is clear that the business and e-shop operator need several details, including an email address, telephone number and possibly a delivery address. The e-shop operator may collect these personal data. For a purchase in a physical shop and the conclusion of a contract—for example, when ordering goods—an email address may not be necessary.

Each purpose therefore requires a different scope of personal data. We should always collect only the personal data needed for the processing purpose, in accordance with the principle of data minimisation.

It is also necessary to define the retention and deletion period for personal data. These periods are also determined by accounting and tax regulations. Under the Accounting Act, contracts, orders and invoices must be retained for 5 or 10 years. Once that period expires, personal data must be deleted from a data-protection perspective.

Informing customers about the conditions of personal-data processing is another business obligation. When personal data is collected, the individual as data subject must be informed how the business processes their personal data.

Online, this obligation is fulfilled through a personal data protection policy, usually found in the website footer.

Final recommendations

When GDPR documentation is set up correctly, every business must address the question of identifying the legal bases. The legal bases are equal and their selection follows rules arising from the GDPR Regulation and practice.

Performance of contractual obligations is the legal basis to apply whenever a contract exists between a business as controller and an individual as data subject. In that case, do not request unnecessary consent to process personal data for the purpose of performing contractual obligations.