What is “contractual necessity” as a legal basis?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
A customer just bought something from your store. You need to send them an order confirmation, a shipping notification, and a delivery update. You didn't ask for their marketing consent at checkout, and you don't need to: those emails are required to fulfill the contract they entered into when they made the purchase. That's contractual necessity as a legal basis under GDPR Article 6(1)(b).
The scope is narrower than it looks. "Necessary to perform the contract" means the processing has to be objectively required for the contract to work. Sending a customer their order details: covered. Adding them to your promotional newsletter: not covered. Emailing them about an upcoming sale: not covered. The contract was for a product purchase, not for marketing communications. Regulators read "necessary" strictly, and enforcement actions have targeted brands that used contractual necessity as a workaround to avoid building proper consent flows.
Pre-contractual processing adds another layer. Article 6(1)(b) also covers processing needed to take steps "at the request of the data subject" before a contract is formed. If someone requests a quote and you need their email to send it, that's covered. But it has to be something they explicitly asked for. If someone fills in a contact form with a general question and you add them to a nurture sequence, they didn't request pre-contractual steps; they asked a question. You'd need consent or legitimate interest for that. The transactional vs. promotional line is the clearest practical guide here.
If you're relying on contractual necessity for anything beyond transactional emails tied directly to a purchase or service, write down your reasoning. You need to show the processing was objectively required, not just useful. A short note in your data register explaining the connection between each email type and the underlying contract takes 10 minutes and removes a lot of risk during audits.
When in doubt, ask yourself: "If I didn't send this, would I be failing to deliver what this person contracted for?" If the honest answer is yes, you're probably fine. If you're stretching to justify it, get consent instead and save yourself the compliance headache.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
