There is a lawful basis for personal data processing when the personal data of an individual is required to fulfill a contract obligation or when the individual asks an organization to do something before entering in a contract.
This does not apply when it is reasonably possible to achieve the same goal without processing the personal data.
As always, the action should be documented for justification about the why and how the personal data was gathered and processed.
When the personal data processing is required for a contract with an individual, a separate consent is not required.
This is quite simple and straightforward.
When in a special category data is necessary for the contract, then it is also required to identify a separate condition for processing this data.
When the contract is with a child under 18, the organization must consider whether they have the necessary competence to enter into the contract. When in doubt, another lawful basis could be applied, for instance, legitimate interests if it demonstrates that the child’s rights and interests are properly considered and protected.
When personal data is being processed on the basis of contract, the individual’s right to object and the right not to be subject to a decision based solely on automated processing does not apply. However, the individual has the right to data portability.
Need Help with GDPR?
Get in touch with us if you need help on the subject.