GDPR Q35

What is legitimate interest as a legal basis?

Q35. What is legitimate interest as a legal basis?

Category: Legal Basis

Legitimate interests is a flexible lawful basis but requires a careful balance between your aims and individuals’ rights.

In simple terms

Apply the three-part test: purpose, necessity, and balancing.
Document your Legitimate Interests Assessment (LIA).
Offer opt-outs when individuals expect a choice.

When to use legitimate interests

It suits activities where the impact on individuals is limited and they would reasonably expect the processing, such as fraud prevention, internal administration, or some B2B marketing.

Avoid using it for intrusive activities or where vulnerable people are involved.
Be prepared to justify why consent or another basis was not appropriate.
Review assessments when processing changes.

Conducting the LIA

Record the purpose test (why it is needed), necessity test (is it proportionate), and balancing test (impact on individuals).

Mitigate risks with safeguards such as opt-outs, minimisation, or anonymisation.
Consult your DPO or legal team for high-risk activities.
Keep LIAs available for ICO review.

Practical steps to take

Identify processing activities where legitimate interests may apply.
Complete and approve an LIA before starting or changing processing.
Update privacy notices to explain the interest pursued.
Provide clear opt-out mechanisms where appropriate.
Review LIAs periodically and when circumstances change.

Real-life examples

Security monitoring

An office uses CCTV for safety. An LIA assesses necessity, sets retention limits, and informs staff and visitors.

Soft opt-in B2B marketing

A business emails existing corporate customers about related products and records an LIA explaining why legitimate interests applies.

Helpful reminders

Individuals can object at any time—respect objections promptly.
Do not rely on legitimate interests for processing that has a significant impact on children without strong safeguards.
Combine LIAs with DPIAs when risk is high.

Key takeaway

Legitimate interests is powerful but requires evidence—think carefully, record your reasoning, and give people control.