I need to bring my Luxembourg organisation into compliance with recital 44 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 44 GDPR — Recital 44 · official text + guide

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 26/906 CSSF 25/892 CSSF 25/893 CSSF 26/915 CSSF 20/758 CSSF 18/698 CSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 44

General Data Protection Regulation · UE 2016/679

(44)	Processing should be lawful where it is necessary in the context of a contract or the intention to enter into a contract.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 44 informs Article 6(1)(b): the contractual basis only covers what is strictly necessary to perform the contract or to take pre-contractual steps requested by the data subject. The CNPD and CNIL routinely sanction organisations that invoke contract to justify targeted advertising, marketing profiling or data enrichment, none of which are necessary for the contract itself. The EDPB (Guidelines 2/2019) locked this interpretation: the necessity test is objective, not subjective.

The contractual necessity test: 4 questions for every processing activity

Is the processing objectively indispensable to deliver the contractual service, or merely useful to the business model?
Did the individual actively request the pre-contractual step (quote, simulation), or are they being prospected?
Is there a less intrusive alternative that would still allow the contract to be performed?
Does the processing outlive the contract without a fresh legal basis (consent, legal obligation, documented legitimate interest)?

If the answer to question 1 is no or to question 4 is yes, the contractual basis collapses and you are in breach from the first processing operation.

How Luxgap automates this risk

Our Luxgap Lawful Basis Validator turns the legal qualification of your lawful bases from a declarative exercise (the DPO ticks a box in the register) into an automated semantic audit that confronts each processing activity with operational reality. An LLM agent analyses your processing descriptions in the register, cross-checks them against the actual data flows detected in Odoo, M365, Salesforce and HubSpot, and surfaces inconsistencies where 6(1)(b) is wrongly claimed.

Automatically detects processing activities declared under contractual basis that actually pursue a marketing, analytics or profiling purpose unrelated to the contract.
Applies the EDPB 2/2019 necessity test to each processing activity and proposes the documented alternative basis (granular consent, legitimate interest with balancing test, legal obligation).
Generates a legal qualification report for each processing activity, citing Recital 44, Article 6(1)(b) and applicable EDPB doctrine.
Alerts in real time when a new CRM workflow or a new Salesforce field introduces a purpose beyond the original contractual perimeter.
Produces an enriched Article 30 register, defensible before the CNPD, that demonstrates the legal robustness of every 6(1) basis.

Available as part of a Luxgap DPO mandate or as a standalone SaaS brick depending on your scope. Request a tailored quote and our team will prepare a demonstration on your actual processing activities, with a free 48h white audit to identify fragile lawful bases before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 44

They trust us

Before we chat