EDPB Guidelines on contract legal basis for online services

Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

These guidelines focus on the aplication of Article 6(1)(b) of the GDPR in the context of online services. The analysis covers general observations, the interaction of Article 6(1)(b) with other lawful bases for processing, the specific scope of Article 6(1)(b), the concept of necessity, and its application to the performance of a contract and steps taken prior to entering into a contract. The final part discusses the applicability of Article 6(1)(b) in specific situations such as processing for service improvement, fraud prevention, online behavioral advertising, and content personalization.