Legitimate interests is often described as the most flexible lawful basis for processing personal data under the GDPR and UK GDPR. That flexibility makes it attractive to businesses, but it also attracts close regulatory scrutiny. Organisations that rely on legitimate interests must be able to articulate why they process personal data, demonstrate that the processing is genuinely necessary, and show that individual rights and freedoms have been properly considered and protected. This page explains how legitimate interests works, when it is appropriate to rely on it, and how a well-documented Legitimate Interests Assessment (LIA) underpins lawful and defensible use of this basis.
Understanding Legitimate Interests Under Data Protection Law
Legitimate interests is set out in Article 6(1)(f) of the GDPR and UK GDPR. It permits the processing of personal data where the processing is necessary for the purposes of a legitimate interest pursued by the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the individual. Unlike consent or contract necessity, legitimate interests does not depend on an explicit external trigger. Instead, it requires the organisation itself to evaluate and justify the lawfulness of its processing through a structured assessment.
Regulators have consistently emphasised that legitimate interests is not a residual or “fallback” basis to be used simply because other lawful bases are inconvenient. Nor should it be automatically selected because it appears flexible. The lawful basis requires active evaluation, transparency, and accountability. In practice, this means that organisations relying on legitimate interests must be prepared to explain their reasoning to regulators and, where necessary, to affected individuals.
Why Businesses Rely on Legitimate Interests
Many business activities fall into a space where processing personal data is genuinely necessary, expected, and proportionate, but where consent would be unworkable or contractual necessity does not apply. Legitimate interests can provide a lawful basis for those activities, allowing organisations to operate efficiently while still respecting privacy rights.
Common examples include direct marketing to existing customers, fraud detection, network and information security, internal data sharing within corporate groups, and certain employee-related processing. These are activities that regulators have recognised as capable of constituting legitimate interests when properly assessed and safeguarded. The benefit for businesses is not simply flexibility, but stability: unlike consent, legitimate interests does not evaporate because an individual withdraws permission, although objections still have to be carefully managed.
When Legitimate Interests Is Not Appropriate
Despite its usefulness, legitimate interests cannot be relied upon in all circumstances. Public authorities cannot use legitimate interests when processing personal data in the performance of their official tasks. Processing that is unexpected, highly intrusive, or likely to cause unjustified harm to individuals is unlikely to survive the required balancing exercise.
Legitimate interests is also generally unsuitable for processing special category data unless additional conditions under Article 9 GDPR are satisfied. Even then, the threshold is high. Regulators routinely challenge organisations that rely on legitimate interests where another lawful basis clearly applies, or where no serious balancing exercise has taken place. Treating legitimate interests as a convenience rather than a structured legal basis is a recurring theme in enforcement cases.
The Three-Part Legitimate Interests Test
To rely on legitimate interests, an organisation must satisfy three cumulative conditions. These conditions form the backbone of both the legal analysis and the Legitimate Interests Assessment.
The first is the purpose test, which asks whether the organisation or a relevant third party is pursuing a legitimate interest. The interest must be lawful, clearly articulated, and real rather than speculative. Commercial interests can qualify, but they must be properly defined and connected to the processing activity. Simply asserting a broad business objective is not sufficient.
The second is the necessity test, which examines whether the processing is necessary to achieve the identified interest. This is a strict test. If the same outcome could reasonably be achieved through less intrusive means, legitimate interests cannot be relied upon. The necessity analysis is closely linked to data minimisation and proportionality principles.
The third is the balancing test, which weighs the organisation’s interest against the rights and freedoms of individuals. Factors such as the nature of the data, the relationship with the individual, reasonable expectations, and the potential impact of the processing all play a central role. Safeguards that reduce privacy impact, such as opt-out mechanisms, security controls, or limited retention, are also critical at this stage.
What Is a Legitimate Interests Assessment (LIA)?
A Legitimate Interests Assessment is the documented analysis that demonstrates compliance with Article 6(1)(f). While the GDPR does not explicitly mandate a written LIA, regulators consistently treat it as essential evidence under the accountability principle. Organisations that rely on legitimate interests without a recorded assessment are often unable to demonstrate that the lawful basis was properly considered before processing began.
An LIA is best understood as a contextual, risk-based evaluation. In straightforward cases it may be concise. In more complex or higher-risk scenarios, it should be detailed and carefully reasoned. What matters is not length, but substance: the assessment must grapple with the specific processing activity and the actual risks to individuals.
Structuring a Robust and Defensible LIA
A well-constructed LIA typically begins with a clear description of the processing activity, including the categories of personal data involved, the purpose of the processing, and the affected individuals. It then identifies the legitimate interest being relied upon and explains why that interest is lawful and genuine.
The necessity analysis should explain why the processing is required to achieve the stated interest and why less intrusive alternatives are not sufficient. Generic statements are unlikely to withstand scrutiny. Regulators expect evidence that alternatives were genuinely considered.
The balancing section is often the most critical. This is where organisations demonstrate that they have considered individuals’ reasonable expectations, the nature of the data, and the potential impact of the processing. Where risks exist, the LIA should identify safeguards that mitigate those risks. The assessment should conclude with a clear outcome and a record of the decision taken.
Importantly, the LIA should be completed before processing starts and revisited when processing changes. It is not a one-off, tick-box exercise.
LIAs, DPIAs, and Broader Governance
LIAs and Data Protection Impact Assessments (DPIAs) serve different but related functions. An LIA assesses whether legitimate interests is an appropriate lawful basis. A DPIA evaluates broader risks arising from high-risk processing. In some cases, an LIA may reveal that a DPIA is required. Where both apply, they should be coherent and consistent, forming part of an organisation’s wider privacy governance framework. Regulators view this integrated approach as a key indicator of accountability and data protection by design.
Transparency and the Right to Object
Relying on legitimate interests carries specific transparency obligations. Privacy notices must clearly explain that processing is based on legitimate interests and describe those interests in meaningful terms. Vague or generic disclosures undermine both transparency and defensibility.
Individuals also have a right to object to processing based on legitimate interests. In the context of direct marketing, that right is absolute and must result in the processing stopping. In other contexts, objections must be assessed on a case-by-case basis, taking into account the individual’s circumstances and the organisation’s interest. Having a clear process for handling objections is an essential operational component of legitimate interests compliance.
Regulatory Developments and Enforcement Trends
Recent guidance from the European Data Protection Board has reinforced the importance of disciplined and well-documented legitimate interest analyses. Regulators have drawn a clear distinction between the “interest” pursued and the “purpose” of processing, a distinction many organisations historically blurred. Enforcement decisions repeatedly highlight failures to conduct LIAs before processing began or to meaningfully engage with the balancing exercise.
In the UK, legislative developments introduced the concept of “recognised legitimate interests” for a narrow set of activities, such as crime prevention and safeguarding. Even in those cases, organisations must still demonstrate necessity and proportionality. These developments do not remove the need for careful analysis; they simply adjust the structure of that analysis for specific purposes.
Common Mistakes Businesses Make
Businesses most often run into difficulty where LIAs are superficial, copy-and-paste documents that do not reflect the reality of the processing. Other common errors include relying on over-broad commercial justifications, ignoring data subjects’ reasonable expectations, or failing to update assessments as processing evolves. These weaknesses frequently become apparent during regulatory investigations, complaints, or audits.
The Value of Doing Legitimate Interests Properly
When implemented correctly, legitimate interests can support sustainable and proportionate data use. A robust LIA does more than satisfy a legal requirement; it improves internal decision-making, clarifies data flows, and strengthens an organisation’s ability to respond to regulatory scrutiny. Organisations that invest in proper assessment and documentation are better placed to manage objections, investigations, and future changes in guidance or business practice.
How We Support Our Clients
We advise organisations across sectors on the strategic use of lawful bases, including when and how legitimate interests can be relied upon. Our work includes assessing processing activities, drafting and reviewing Legitimate Interests Assessments, aligning LIAs with DPIAs and privacy notices, and supporting clients during regulatory inquiries or enforcement actions. Our focus is not only on legal correctness, but on creating documentation that stands up in practice.
Conclusion
Legitimate interests is a powerful tool, but it is not a shortcut. Its flexibility is matched by heightened responsibility. Organisations that understand and respect that balance, and that document their reasoning through well-constructed LIAs, are best positioned to use personal data lawfully, transparently, and defensibly in a complex regulatory environment.