Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

What it covers

These guidelines analyse the applicability of Article 6(1)(b) GDPR, the contractual necessity lawful basis, to processing of personal data in the context of online service contracts. They set out the objective necessity test, its interaction with other lawful bases, and its application to service improvement, fraud prevention, online behavioural advertising and content personalisation.

Why it matters

It is the central reference for determining whether an online service can lawfully rely on contractual necessity rather than consent or legitimate interests, particularly for advertising-funded services.

Refer to it when

• assessing whether processing for an online service is genuinely necessary for contract performance
• distinguishing contractual necessity from consent or legitimate interests
• evaluating whether behavioural advertising can be justified under Article 6(1)(b)
• reviewing processing that occurs prior to contract conclusion

Questions this document addresses

• What does 'necessary for the performance of a contract' require under Article 6(1)(b)?
• Can online behavioural advertising be based on contractual necessity?
• How does Article 6(1)(b) interact with the other lawful bases in Article 6(1)?
• When is processing for service improvement or fraud prevention covered by Article 6(1)(b)?
• What conditions apply to processing prior to entering into a contract?

Topics

• Lawful basis
• Marketing & targeting
• Controller & processor