When to use the legal basis that processing personal data is necessary for the performance of a contract This legal basis will be used if processing personal data is necessary for the performance of a contract or if requested by the data subject, for the preparatory steps to enter into a contract. This request does not have to be expressly worded – if prospective students submit an application to the University, then their request to process the data is implied. It is important to note that the only requirement is for the data subject to be party to the contract. This means that if a data controller only acts as a facilitator to enable a data subject to enter into a contract with a third party, then this legal basis is applicable. Examples HR evaluating a job applicant’s personal data to decide whether to send a job offer will be ‘steps taken at the request of the data subject prior to entering into a contract’. Accommodation Services helping a student apply for a private flat to rent during the academic year even though they are not party to the contract. This article was published on 2023-11-09
