The German Federal Court of Justice on the term ‘contract’ under Article 6(1)(b) of the GDPR

In a ruling from December 12, 2025 (II ZR 132/24) (link only available in German), the German Federal Court of Justice (BGH) addressed the question of when data processing is permissible for the purpose of fulfilling a contract. The proceedings arose from a dispute within an association. A member demanded the disclosure of other members’ email addresses so that he could contact them prior to a general meeting and campaign for his position in a vote. The association refused this request, citing, amongst other things, data protection arguments.

A key issue was the interpretation of the term ‘contract’ in Article 6(1)(b) of the GDPR. The court clarified that this term is not to be interpreted in accordance with national civil law, but autonomously under data protection law. In the court’s view, the concept of a contract is not limited to traditional civil law contracts. Rather, the decisive factor is whether a legal relationship is based on a voluntary and self-determined decision by the data subject.

This is precisely the case when joining an association. Anyone who joins an association consciously decides to become a member of a private organisation. This membership relationship is therefore to be understood as a contract-like relationship, the content of which is derived from the association’s statutes. Data processing necessary to enable members to exercise their rights within this organisation can therefore be based on Article 6(1)(b) of the GDPR. The disclosure of email addresses to the association member would therefore be permissible on this basis.

With this decision, the BGH clarifies that the concept of a contract within the meaning of Article 6(1)(b) of the GDPR is not limited to the definition under civil law. Legal relationships may therefore also fall under the concept of a contract – and thus under its performance – if they are based on a voluntary decision and data processing is necessary for the exercise of the associated rights.

We would be happy to assist you in reviewing your processes to determine whether data processing in the context of memberships, platform usage or similar relationships may be based on Article 6(1)(b) of the GDPR. At the same time, it is advisable to review relevant processes and privacy notices and to clearly document the legal basis.

May 18, 2026