Under GDPR, processing incidental to the service provided to the customer is allowed. This statement is:

• A. True.
• B. False.
• C. Only with consent.
• D. Only if essential for contract performance.

Answer: (A)

Processing incidental data is allowed because it’s typically necessary to fulfil the contract and deliver the service to the customer. When you provide a service, you often need to process personal data in order to operate, communicate with the customer, handle payments, support, and improve the service. This kind of processing can be supported by a lawful basis tied to contract performance, so you don’t always need explicit consent for every incidental data handling.

The key is that the processing must be necessary or proportionate to providing the service, must align with the purposes you disclosed to the customer, and be done with appropriate safeguards (transparency, data minimization, security, and retention limits). If the processing goes beyond what is reasonably necessary to deliver the service, another lawful basis (such as consent or legitimate interests) should be considered. But for typical incidental processing tied to service delivery, GDPR allows it.