Legal basis and contracts

It depends on the purposes of data processing. If the data processing is related to give execution to the contract, article 6, paragraph 1, letter b GDPR, states that the processing is lawful under GDPR when "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract".

Of course, this is limited only to the performance of the contract. You must inform the data subject about data processing by providing your privacy notice. You may need consent form even if you are working on the contractual legal basis if your data processing purposes go beyond the contract (i.e. marketing purposes).

You may find some useful information here:

• Everything you need to know about the GDPR Privacy Notice: https://advisera.com/articles/gdpr-privacy-notice-6-key-elements-to-include/
• Is consent needed? Six legal bases to process data according to GDPR: https://advisera.com/eugdpracademy/knowledgebase/is-consent-needed-six-legal-bases-to-process-data-according-to-gdpr/
• Four main questions for obtaining and managing data subjects’ consent under GDPR: https://advisera.com/eugdpracademy/knowledgebase/four-main-questions-for-obtaining-and-managing-data-subjects-consent-under-gdpr/

You may also consider taking our free Foundation GDPR Course: https://advisera.com/training/eu-gdpr-foundations-course//