GDPR legitimate interest is one of six lawful bases for processing personal data. Article 6(1)(f) requires a legitimate interest, necessary processing and a balance that is not overridden by the individual’s interests or fundamental rights and freedoms. Choose the basis for a specific purpose before processing begins; convenience or difficulty obtaining consent does not establish eligibility.
This guide helps you select and record the appropriate lawful basis. If legitimate interests is a candidate, the triple-test worked example helps document the assessment. The separate marketing and objection guide addresses campaign decisions and individual objections.
What Is Legitimate Interest Under the GDPR?
Legitimate interest is a lawful basis that permits data processing when three conditions are simultaneously met: the controller (or a third party) pursues a genuine interest, the processing is necessary to achieve that interest, and the interests or fundamental rights of the data subject do not override it. Unlike consent, legitimate interest does not require the individual to opt in. Unlike a legal obligation or contractual necessity, it demands an active balancing exercise that must be documented.
The GDPR does not define “legitimate interest” exhaustively, but Recitals 47 to 49 provide concrete examples: fraud prevention, network and information security, direct marketing, and intra-group data transfers for internal administrative purposes. The European Data Protection Board (EDPB) explains in its consultation-version Guidelines 1/2024 that the interest must be lawful, sufficiently specific, and real rather than speculative.
Legitimate interest vs consent
The most critical distinction is control. Valid GDPR consent places the decision in the data subject’s hands: processing may only occur after an affirmative, informed, and freely given agreement. GDPR legitimate interest shifts the burden to the controller, who must demonstrate through a documented assessment that processing is justified even without the individual’s prior agreement.
A refusal or withdrawal of consent is not an invitation to relabel the same processing as legitimate interests. Determine the appropriate basis transparently from the outset; a separate purpose, such as retaining a tax record, may have its own independently applicable legal obligation.
Common scenarios for legitimate interest
Legitimate interest is appropriate when the processing serves a genuine, documented purpose that cannot reasonably be achieved through other means, and the impact on individuals is proportionate. Typical scenarios include:
- Fraud prevention and detection – processing transaction data to identify unusual patterns
- IT security – logging access attempts and monitoring network integrity
- Direct marketing – potentially, after the full assessment and any separate ePrivacy consent or existing-customer exception requirements
- Internal administration – sharing employee data within a corporate group for payroll, compliance, or operational purposes
Public authorities cannot use Article 6(1)(f) for processing in performance of their tasks. Special-category processing needs a separate Article 9(2) condition in addition to its Article 6 basis. Unexpected use, children’s data or a power imbalance requires particularly careful assessment; none can be resolved by merely adding a safeguard to a form.
Compare Bases by Purpose Before Writing an LIA
A single customer relationship may contain several purposes with different bases:
| Processing purpose | Basis to examine first | Boundary to document |
|---|---|---|
| Use a delivery address to fulfil an order | Contract, Article 6(1)(b) | Data must be objectively necessary for that contract; adding a term does not create necessity |
| Retain an invoice under an applicable tax rule | Legal obligation, Article 6(1)© | Identify the Union or Member State law and the records and period it requires |
| Detect account takeover using proportionate access logs | Legitimate interests, Article 6(1)(f) | Test alternatives, retention, access and effects on legitimate users |
| Place optional advertising trackers | Applicable ePrivacy consent rules, plus the GDPR basis for subsequent processing | A legitimate-interest assessment does not override a consent requirement |
| Reuse customer data for an unrelated profiling product | Reassess lawfulness, purpose compatibility and transparency | An existing contract or earlier LIA does not automatically cover a new purpose |
Start with the actual operation, not the preferred basis. If no basis supports the proposed design, change or stop that processing. Record the selected basis in the accountability file and use the privacy notice to explain it for the relevant purpose.
What to Check Before Relying on Legitimate Interests
Every reliance on GDPR legitimate interest must be supported by a documented assessment known as the Legitimate Interest Assessment (LIA), also called the triple test. This assessment has three sequential stages, and failure at any stage means the legal basis cannot be used.
Identify a legitimate interest
The controller must articulate what interest it pursues and confirm that the interest is lawful. Recital 47 GDPR notes that the existence of a legitimate interest requires “careful assessment” and that the data subject should reasonably expect the processing at the time and in the context of data collection. The interest can belong to the controller, a third party, or the broader public. A vague or generic statement such as “business purposes” is insufficient. Supervisory authorities have consistently required controllers to be specific – for instance, “reducing credit card fraud losses” is far more defensible than “improving business operations.”
Demonstrate necessity
The processing must be genuinely necessary to achieve the stated interest. “Necessary” does not mean indispensable, but it does mean that no less intrusive alternative would achieve the same result. The purpose limitation principle is directly relevant here: the data collected must be adequate, relevant, and limited to what is needed. If the same objective can be achieved by processing fewer data points, by anonymising the data, or by using a different method entirely, the necessity test fails.
For example, monitoring every keystroke of an employee to prevent data leaks would likely fail the necessity test when less intrusive measures – such as restricting access to sensitive files – could achieve the same security objective.
Balance interests against data subject rights
The final and most fact-sensitive stage requires the controller to weigh its legitimate interest against the impact on the data subject’s rights and freedoms. The EDPB consultation guidance identifies factors including:
- The nature and sensitivity of the personal data involved
- The reasonable expectations of the data subject
- The status of the data subject (children require heightened protection)
- The relationship between the controller and the data subject
- The safeguards in place to mitigate any negative impact
The ICO’s legitimate-interest resources concern UK law and can provide useful assessment prompts. In the EU, the CJEU’s KNLTB judgment, C-621/22, of 4 October 2024, confirms that a commercial interest can qualify, while necessity and balancing still need assessment. It did not authorise all marketing disclosures. Use the worked triple test to record alternatives, impacts and a reasoned outcome.
Common Mistakes to Avoid
Enforcement actions across Europe reveal recurring errors that organisations should actively guard against.
Treating a preferred basis as a conclusion. The Irish DPC’s December 2022 Meta decisions, announced in January 2023 with fines totalling EUR 390 million, concerned reliance on contractual necessity for behavioural advertising. They do not substantiate a claim that those fines were imposed for a failed legitimate-interest assessment.
Failing to document the assessment. A legitimate interest assessment is not optional. The accountability principle requires controllers to demonstrate compliance proactively. Organisations that invoke legitimate interest without maintaining a written LIA face significant enforcement risk. In practice, the assessment should be reviewed whenever the nature, scope, or context of processing changes, and at an appropriate review interval as part of a broader GDPR compliance checklist.
Ignoring the right to object. Data subjects have the right to object to processing based on legitimate interest under Article 21 GDPR. Once an objection is received, the controller must stop processing unless it demonstrates compelling legitimate grounds overriding the person’s interests, rights and freedoms, or processing is for establishing, exercising or defending legal claims. Pending verification of overriding grounds, Article 18(1)(d) provides for restriction. For direct marketing, the right to object is unconditional and processing must cease immediately. Failure to implement effective objection mechanisms has been the basis for multiple enforcement actions across Europe.
Skipping the DPIA. When processing based on legitimate interest is likely to result in a high risk to individuals, a Data Protection Impact Assessment (DPIA) is mandatory under Article 35 GDPR. The DPIA and the LIA serve complementary functions: the LIA establishes that the legal basis is valid, while the DPIA evaluates and mitigates risk.
Practical Steps for Organisations
Organisations intending to rely on GDPR legitimate interest should embed the following practices into their data privacy governance:
- Prepare a written LIA before processing begins. Document the interest, the necessity analysis, and the balancing test. Seek advice from the DPO where designated and assign the controller’s responsible decision-maker; the DPO advises independently rather than assuming management’s accountability.
- Include legitimate interest in your privacy notice. Transparency is a legal requirement. Your privacy notice must identify the specific legitimate interest pursued for each relevant processing activity.
- Implement and test objection mechanisms. Ensure that data subjects can easily exercise their right to object and that objections are processed promptly.
- Review assessments regularly. A LIA is not a one-time exercise. Changes in business context, data volumes, technology, or regulatory guidance can shift the balance.
- Maintain records. Keep the LIA alongside your Records of Processing Activities (ROPA) so that it is immediately available if a supervisory authority requests it.
FAQ
Can legitimate interest be used for marketing purposes?
Yes, Recital 47 GDPR explicitly recognises direct marketing as a potential legitimate interest. However, the controller must still conduct the three-part balancing test and provide an easy opt-out mechanism. For electronic marketing (email, SMS), the ePrivacy Directive imposes additional requirements that may require consent, subject to applicable national rules and exceptions. Where required, consent is a legal condition, not simply a safer option.
How is legitimate interest different from contractual necessity?
Contractual necessity under Article 6(1)(b) applies when processing is strictly required to perform a contract the data subject has entered into. Legitimate interests may be considered for a separate purpose whether or not a contract exists, but only if all its conditions are satisfied. Processing beyond contractual necessity does not automatically qualify. The Meta decision demonstrated that conflating the two can lead to substantial penalties.
What happens if a supervisory authority rejects my legitimate interest assessment?
If the assessment is found inadequate, the supervisory authority may order the controller to stop processing and impose a fine of up to 4% of global annual turnover. The controller may also be required to notify affected data subjects and delete data that was processed without a valid legal basis.