On its entry into force, the GDPR would make reliance on data
subjects' consents inappropriate for many
personal data processing activities. A practical tip to self-test
current consents: if it seems difficult for a controller to obtain
a valid consent, perhaps there is another legal ground that should
apply. When implementing a GDPR compliance strategy, it is of high
importance to know the legal grounds for lawful processing but also
what their context is.
- Contractual performance
Personal data processing would be lawful, if it is necessary
either for the performance of a contract to which the data subject
is a party or to act at the request of the data subject prior to
entering into such contract. This would be the case where a
customer is ordering a product or a service through the Internet
and the processing of his or her name, address and credit card
details is required for the delivery and payment. Where a third
party performs the delivery, it would be
