THE JURIDICAL NATURE OF CONTRACTS FOR THE EXCHANGE OF PERSONAL DATA

Abstract

Personal data such as IP addresses, geolocation details, email accounts, and social media profiles has increasingly come to represent a valuable asset within the global data economy, serving as a driver of innovation and shaping new commercial practices. Businesses often engage in the circulation and commercial use of such data, while individuals frequently provide their information in return for complimentary services, discounts, or reduced costs. This study, conducted through doctrinal legal research and a descriptive–analytical approach, explores the contractual dimension of these practices and their legal implications. Identifying the nature of agreements between data subjects and data controllers is essential for clarifying the scope of rights, duties, and liabilities arising from them. Despite the centrality of this issue, the European Union has not fully articulated a coherent position on the commodification of personal data; although the GDPR safeguards personal data as a fundamental right, many European jurists oppose its treatment as a tradable commodity. In contrast, Iranian law contains no specific statutory provisions on contractual exchange or exploitation of personal data, and legal reasoning must instead rely on general principles of contract law. This divergence underscores the need for a more systematic understanding of personal data contracts and for frameworks that balance the protection of privacy with the facilitation of legitimate economic interests.