Legitimate interest is one of the six lawful bases the GDPR provides for processing personal data. Enshrined in Article 6(1)(f) of the GDPR, it permits organisations to process personal data without consent when a genuine interest exists, the processing is necessary, and the data subject’s fundamental rights do not override it.
This guide applies legitimate interests to marketing disclosures and the decisions that follow an objection. For choosing between lawful bases, use the basis-selection guide; for writing the assessment itself, use the worked triple test.
What Does Article 6(1)(f) Actually Require?
Article 6(1)(f) states that processing is lawful when it “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.” Three cumulative conditions follow:
- A legitimate interest must exist – belonging to the controller, a third party, or the public.
- The processing must be necessary to pursue that interest.
- The data subject’s rights must not override the controller’s interest.
Unlike valid GDPR consent, legitimate interest requires no opt-in. The trade-off: the controller bears the full burden of justification and must document the reasoning before processing begins.
Recital 47 adds that the data subject should “reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.” Reasonable expectations are a factor in the balancing assessment; they do not replace the separate interest and necessity conditions.
Check the Three Conditions for a Proposed Campaign
The GDPR and the CJEU’s case law structure the assessment into three sequential stages. Each stage must be satisfied before moving to the next.
Step 1: Identify a legitimate interest
The controller must articulate the specific interest and confirm it is lawful. Vague formulations such as “improving our business” are consistently rejected. The interest must be real, current, and sufficiently specific. Recitals 47 through 49 list recognised interests: fraud prevention, network security, direct marketing, and intra-group transfers for internal administration.
A landmark 2024 CJEU ruling (Case C-621/22, KNLTB v. Autoriteit Persoonsgegevens) confirmed that purely commercial interests, including marketing, can qualify under Article 6(1)(f), ending years of conflicting interpretations across member states.
Step 2: Apply the necessity test
“Necessary” does not mean indispensable, but it does mean no less intrusive alternative would achieve the same result. This step links directly to the purpose limitation principle: if anonymisation, aggregation, or collecting fewer data points can achieve the objective, the necessity test fails.
Example: an employer monitoring every keystroke to prevent data leaks would likely fail the necessity test because restricting file-access permissions achieves the same security objective with far less impact on privacy.
Step 3: Balance against data subject rights
The most fact-sensitive stage. The controller weighs its interest against the impact on individuals:
- Nature of the data – special categories tip the balance heavily toward the data subject.
- Reasonable expectations – would the individual expect this processing at the time of collection?
- Relationship – a direct customer relationship supports stronger expectations than third-party-sourced data.
- Safeguards – encryption, access controls, minimisation, and deletion schedules reduce impact.
- Vulnerability – children and vulnerable groups receive heightened protection (Recital 38).
The balancing exercise must be documented in a Legitimate Interest Assessment (LIA) and maintained alongside your Records of Processing Activities.
When Does Legitimate Interest Work?
Legitimate interest works best when the individual would reasonably expect the processing and adequate safeguards are in place. The main scenarios:
Fraud prevention and network security. Recitals 47 and 49 recognise these interests, but necessity and balancing remain essential. Define the threat, data used, access and retention. A payment provider’s role must also be clear: a processor does not select a separate Article 6 basis for processing solely on its controller’s instructions.
Direct marketing. Recital 47 recognises that marketing may involve a legitimate interest. This does not authorise every campaign, recipient list or disclosure. Electronic messages and device tracking must separately satisfy applicable ePrivacy rules, including any consent requirement or narrowly defined exception.
Intra-group data transfers. Recital 48 recognises that controllers within a group of undertakings may have a legitimate interest in transmitting personal data for internal administrative purposes – HR, centralised IT, group-wide compliance. The three-part test still applies to each transfer.
When Does Legitimate Interest Fail?
Does legitimate interest work for children’s data, power imbalances, or unexpected processing?
Children’s data require particular protection. Assess age, vulnerability, comprehension, consequences and realistic safeguards. Article 6(1)(f) is not categorically unavailable, but a controller must substantiate the balance rather than assuming an ordinary adult-customer assessment applies.
Power imbalances increase the need for scrutiny. An employee may not realistically challenge monitoring by an employer. Evaluate less intrusive controls and effects on employment, private life and autonomy. An objection link does not by itself neutralise those effects.
Unexpected processing weighs against the controller; do not treat a privacy-notice sentence as proof of reasonable expectations. The €390 million Meta decisions announced in January 2023 concerned reliance on contractual necessity for behavioural advertising, not a blanket ruling that every unexpected use fails legitimate interests.
How to Document a Legitimate Interest Assessment
The GDPR accountability principle requires controllers to demonstrate compliance proactively. Supervisory authorities can request an LIA at any time. A robust LIA contains:
- Processing description – what data, from whom, for what purpose.
- Legitimate interest identification – stated in specific, concrete terms.
- Necessity analysis – why less intrusive alternatives would not achieve the objective.
- Balancing test – impact on data subjects, safeguards applied, and conclusion.
- Review schedule – date of assessment and triggers for reassessment.
Where processing is likely to create high risk, a DPIA is required in addition to the lawful-basis assessment. Screen the activity before deciding which assessment work is needed.
Store the completed LIA alongside your GDPR compliance checklist and Records of Processing Activities.
Apply the KNLTB Decision Without Turning It into an Approval
The CJEU’s 4 October 2024 judgment in C-621/22 confirms that a commercial interest can be legitimate. It does not mean selling a membership list is lawful whenever it generates revenue. Necessity and balancing still require assessment in the actual circumstances.
For a membership organisation considering sponsor marketing, compare disclosing member contact details with sending a relevant communication itself or letting members choose to contact the sponsor. Record whether a less intrusive route can achieve the objective effectively. Examine the members’ relationship with the organisation, how the data were collected, the sponsor’s intended uses, onward disclosure and the effect of receiving an unexpected approach.
A useful decision can refuse the disclosure while permitting a narrower communication that satisfies the applicable marketing rules. If the chosen design changes, update the LIA and information given to members before the new use begins. Link the record to the triple-test methodology, rather than treating the case name as a substitute for the analysis.
The Irish DPC’s Meta decisions illustrate a separate lesson: correctly identify the legal basis being assessed. A sanction under Article 6(1)(b) should not be repackaged as an Article 6(1)(f) case.
Handle Objections as Individual Decisions
For a non-marketing objection under Article 21(1), record the person’s particular situation and assess whether the controller can demonstrate compelling legitimate grounds overriding their interests, rights and freedoms, or processing is needed for legal claims. Where Article 18(1)(d) applies, restrict processing while that verification occurs. Record the decision and explanation, with the normal Article 12 response deadline.
For direct marketing, stop processing for that purpose, including related profiling, when the person objects. Do not reopen the balancing test. Maintain only the information necessary to honour the suppression and explain that purpose; suppressing contact and retaining an unrestricted marketing profile are different actions. Coordinate the decision with recipients and service providers so the next campaign does not reimport the person.
Practical Checklist for Getting It Right
- Draft a written LIA before processing begins – not after a complaint arrives.
- State the actual interest and evidence supporting it, such as informing existing members about a particular service; avoid unsupported performance targets.
- Test necessity: could anonymisation or data minimisation achieve the same result?
- Evaluate impact from the data subject’s perspective.
- Implement objection mechanisms under Article 21 – for direct marketing, the right to object is unconditional.
- Review each LIA when facts or scope change and at a frequency appropriate to the activity; GDPR prescribes no universal annual LIA interval.
- Align LIAs with your broader data privacy principles framework.
FAQ
Can I use GDPR legitimate interest instead of consent for email marketing?
Potentially, if the full three-part assessment supports the processing and applicable ePrivacy rules permit the message. An existing-customer relationship and opt-out are not sufficient by themselves. Where prior consent is required, legitimate interests does not replace it.
Is a Legitimate Interest Assessment legally required?
The GDPR does not prescribe a document called an LIA or a single template. Articles 5(2), 6(1)(f) and 24 require a demonstrable assessment of the conditions before reliance on the basis. Keep written reasoning proportionate to the processing, together with the evidence and review triggers.
What happens if a data subject objects to processing based on legitimate interest?
Under Article 21, the controller must cease processing unless it demonstrates “compelling legitimate grounds” that override the data subject’s interests. The controller may also rely on the establishment, exercise or defence of legal claims where applicable. For direct marketing, processing for that purpose must stop with no further balancing test.
When should I use a DPIA alongside a Legitimate Interest Assessment?
A DPIA is required where processing is likely to result in high risk, including applicable Article 35(3) cases and national lists. The screening guide helps decide this; DPIA implementation addresses risks and mitigations. A marketing LIA does not replace a required DPIA.