The French data protection authority ('CNIL') issued, on 21 February 2020, guidance ('the Guidance') on relying on the performance of a contract between the data controller and the persons concerned as a legal basis for processing under the General Data Protection Regulation (Regulation (EU) 2016/979) ('GDPR'). In particular, CNIL highlighted that a contract can constitute a legal basis for processing provided that there is a contractual relationship between the controller and the concerned person or the processing is necessary to implement pre-contractual measures requested by the data subject and the contract is valid under the applicable law.

In addition, CNIL noted that the processing must be objectively necessary for the performance of the contract. CNIL indicated that the processing must not fulfil any purposes of the data controller, other than the performance of the contract, and as such that necessity should not be assessed based on the form of the contract, but instead on the basis of the objective pursued by the contract and the common agreement between the parties to the contract. Moreover, CNIL stated that if the contract ends or is breached, the data retained by the controller must subsequently be deleted on the basis of Article 17 of the GDPR. 

Furthermore, the Guidance includes a question and answers section, which outlines, among other things, guidance on determining whether a processing activity is necessary, and the consequences of using the performance of a contract as a legal basis.

You can read the Guidance, only available in French, here.