Privacy, GDPR, Contratti