A legitimate interests assessment (LIA) records why a particular processing operation can rely on Article 6(1)(f) GDPR. It must establish a lawful, specific interest, demonstrate necessity and weigh the impact on people before processing begins. A useful assessment can also end in a refusal or a narrower design.
Do not confuse separate Meta proceedings. The Irish DPC’s December 2022 Facebook and Instagram decisions, announcing fines totalling €390 million, concerned reliance on contractual necessity for behavioural advertising. They were not a €390 million CJEU fine for legitimate interests.
To appropriately invoke legitimate interests under Article 6(1)(f) of the GDPR, it is imperative to conduct a thorough triple test. This test assesses whether that legal basis is available and aims to prevent potential abuses, especially since obtaining explicit consent from data subjects is not required in this context.
This page turns a proposed legitimate-interest basis into a documented purpose, necessity and balancing decision. Use the lawful-basis selection guide first if the basis is undecided, or the marketing and objection guide for campaign-specific decisions.
1. Understanding “Legitimate Interests”
According to Article 6(1)(f) of the GDPR:
“The processing is lawful only if and to the extent that at least one of the following applies: f) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, particularly where the data subject is a child.”
These provisions allow data controllers to collect and process personal data without obtaining consent, provided they have a legitimate reason to do so. However, to prevent potential misuse, the GDPR adds additional requirements for invoking legitimate interests. These are encapsulated in the following triple test:
- Objective Test: Does the controller have a legitimate interest in processing the data?
- Necessity Test: Is the processing of data genuinely necessary for the stated purpose?
- Balance Test: Do the interests of the data subject outweigh the legitimate interest of the controller?
The CNIL guidance on legitimate interests explains that the interest must be lawful, sufficiently precise, and real and present. This is only the first step of the assessment.
2. Practical Examples of Legitimate Interests under the GDPR
The GDPR provides specific instances where legitimate interests can be considered a valid legal basis for data processing. These examples, highlighted in Recitals 47, 48, and 49 of the GDPR, include:
- Fraud Prevention: A key area where legitimate interests are often invoked, highlighting the necessity of processing personal data to protect against fraudulent activities.
- Network and Information System Security: As elaborated in Recital 49, ensuring the security of network and information systems is a paramount concern. This involves processing personal data as strictly necessary to safeguard against accidental or unlawful events that compromise the integrity, availability, and confidentiality of stored or transmitted data.
- Commercial Prospecting: The use of personal data for business development and marketing purposes, within certain limits, can be justified under legitimate interests. On 4 October 2024, the CJEU confirmed in its KNLTB ruling (Case C-621/22) that purely commercial interests – such as selling members’ contact data to sponsors – can qualify as legitimate interests under Article 6(1)(f), provided the necessity and balancing tests are satisfied. For a real-world enforcement example, see our analysis of outbound sales GDPR fines.
The European Commission further clarifies that legitimate interests may be applicable when processing occurs in the context of a customer relationship, for purposes such as marketing, fraud prevention, or ensuring the security of network and IT systems.
If we analyze Recital 49 of the GDPR, we observe that the processing carried out to ensure the security of information systems, based on legitimate interest, has been extensively mentioned: 'The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring the security of the network and information, that is, the ability of a network or an information system to withstand, at a given level of confidence, accidental events or illegal or malicious actions that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal data, as well as the security of the related services offered or made accessible via these networks and systems, by public authorities, Computer Emergency Response Teams (CERT), Computer Security Incident Response Teams (CSIRT), providers of networks and electronic communications services, and providers of technology and security services, constitutes a legitimate interest of the data controller concerned. This could involve, for example, preventing unauthorized access to electronic communication networks and the distribution of malicious code, stopping ‘denial of service’ attacks, and addressing damage to computer and electronic communication systems.
3. Public Authorities Performing Their Tasks
It is important to remember that the legal basis of legitimate interests cannot be used by public authorities for processing in the performance of their tasks; Recital 47 explains why: “Considering that it is the responsibility of the legislator to provide by law the legal basis for the processing of personal data by public authorities, this legal basis should not apply to processing carried out by public authorities in the performance of their tasks.”
4.1 Identifying the Interests of the Data Controller or a Third Party and Their Legitimacy
Firstly, it is necessary to clearly identify the interests and objectives of the data controller or third party under which the processing is operated. The following questions can be asked:
- Why is the processing being carried out?
- What benefits are expected from the processing?
- Who benefits from the processing?
- What would be the impact if the organization could not implement the processing?
Recital 47 is useful in this analysis: “The existence of a legitimate interest would need careful assessment, including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.” In the context of a business relationship, it is useful to consider the reasonable expectations of individuals regarding the processing of their data. For example, a relevant offer to a professional contact may be less unexpected than disclosure to an unrelated advertiser. Still assess the actual relationship and applicable national electronic-marketing rules; a B2B label does not dispense with that analysis.
The french CNIL indicates that "the interest pursued by an entity can be presumed if the following 3 conditions are met:
- The interest is manifestly lawful in view of the law;
- It is determined clearly and precisely;
- It is real and present for the concerned entity, and not fictitious.
4.2 The Condition of Necessity
The organization must then ensure that the processing is necessary (see Art. 6: “the processing is necessary for the purposes of legitimate interests”).
This condition can be broken down into two points:
On one hand, it is necessary to verify that the processing actually achieves the intended purpose, rather than serving other objectives. This condition often poses problems in cases where an organization claims to collect data for one purpose, while in reality, it uses the data for entirely different purposes. Attention must be paid to this as it represents a real and significant risk of deviation. On the other hand, it is necessary to ensure that there is no less intrusive means of achieving the same objective than implementing the processing. Therefore, the following questions can be asked:
- Will this processing actually help the organization achieve the initially stated objective?
- Is the processing proportionate to this objective?
- Is it possible to achieve the same objective without the processing?
- Is it possible to achieve the same objective by processing less data, or by processing the data in a less intrusive manner (also consider the principle of data minimization)?
The fundamental interests and rights of the data subject could, in particular, prevail over the interest of the data controller when personal data are processed in circumstances where data subjects do not reasonably expect further processing.
Generally, “necessary” means that the processing must be a targeted and proportionate means of achieving the stated objective. Again, the legal basis of legitimate interests cannot be relied upon if there is another reasonable and less intrusive means to achieve the same result.
4.3 The Balancing Condition
To understand the balancing test, we need to revisit Article 6. Indeed, the legitimate interests of the data controller (DC) may justify this legal basis “unless the interests or fundamental freedoms and rights of the data subject that require protection of personal data prevail.”
The question is whether the individual’s interests or fundamental rights and freedoms override the identified legitimate interest. A business benefit alone does not answer that question.
Recital 47 adds further elements to the analysis of this balancing condition:
- “unless the interests or fundamental freedoms and rights of the data subject prevail, taking into account the reasonable expectations of the data subjects based on their relationship with the controller”
- “the existence of a legitimate interest should be subject to careful assessment, particularly to determine whether a data subject can reasonably expect, at the time and in the context of the collection of personal data, that it may be processed for a particular purpose”. This assessment should also consider the purposes of processing declared to the data subject
- “The interests and fundamental rights of the data subject may, in particular, prevail over the interest of the data controller when personal data are processed in circumstances where data subjects do not reasonably expect further processing”
The reasonable expectations of the data subjects - in English “reasonable expectations of data subjects based on their relationship with the controller” - are thus essential elements to consider.
The CNIL states that “the entity must therefore strike a balance, a weighing of the rights and interests at stake, and verify in this context that the interests (commercial, security of goods, fraud prevention, etc.) it pursues do not create an imbalance to the detriment of the rights and interests of the individuals whose data is processed.” Then “the entity must first identify all kinds of consequences that its processing may have on the data subjects: on their privacy but also, more broadly, on all the rights and interests covered by the protection of personal data.” Finally, “The entity must then take into account, in the weighting between its legitimate interest and the rights and interests of the persons, their ‘reasonable expectations’.”
A series of questions can be posed to clarify these aspects:
-
General Context of Processing
- Are there any Article 9 or 10 data involved? (See special categories of personal data)
- Are these data likely to be considered particularly “private” or sensitive by the individuals?
- Are data of children, minors, or vulnerable individuals being processed?
- Are data related to the personal or professional capacity of individuals being processed?
-
Relationship with the Data Subjects
- Is there a relationship with the individual?
- What is the nature of this relationship, and how have the data been used in the past?
- Were the data collected directly from the individuals?
- What information were they provided with?
- How long ago were the data collected? Are there any technological or contextual changes since then that would affect expectations?
5. Worked decision: investigating repeated account takeover
Consider a retailer investigating repeated unauthorised logins. The interest is preventing account takeover and protecting customers; “improving the business” is too broad. The proposed data are login time, account identifier, IP address and failed-authentication events.
For necessity, compare full browsing histories with a narrower set of authentication events. If the latter identifies the attack adequately, collecting unrelated page views fails the necessity test. Record that rejected alternative and the evidence from the security team. Set a retention period tied to investigation needs, with a documented route to preserve relevant events for an actual dispute.
For balancing, assess the effect of false positives: a blocked account can deny someone access to purchases or essential records. Restrict access to investigators, provide a way to challenge the block, and avoid reusing security logs for advertising. These safeguards reduce impact; they cannot make unnecessary collection necessary. The IP-address guide explains why the logs should still be assessed as personal data.
The decision record should name the processing owner, identify the data and recipients, set the permitted purpose and retention, explain remaining adverse effects, and state the approval or refusal. Link it to the privacy notice and right-to-object procedure. Reopen it when the team proposes device fingerprinting, new recipients or a new secondary purpose. Separately screen whether a DPIA is required; passing the LIA does not resolve high-risk processing obligations.
6. Key Texts
The aforementioned Article 6.
-
Recital 47 “The legitimate interests of a data controller, including those of a data controller to whom personal data may be disclosed, or of a third party, may constitute a legal basis for processing, unless the interests or fundamental rights and freedoms of the data subject prevail, taking into account the reasonable expectations of the data subjects based on their relationship with the data controller. Such a legitimate interest could exist, for example, where there is a relevant and appropriate relationship between the data subject and the data controller in situations such as where the data subject is a client of the data controller or is in the service of the data controller. In any case, the existence of a legitimate interest should be subject to careful assessment, particularly to determine whether a data subject can reasonably expect, at the time and in the context of the collection of personal data, that it may be processed for a particular purpose. The interests and fundamental rights of the data subject may, in particular, prevail over the interest of the data controller when personal data are processed in circumstances where data subjects do not reasonably expect further processing. Given that it is the responsibility of the legislator to provide by law the legal basis for the processing of personal data by public authorities, this legal basis should not apply to processing carried out by public authorities in the performance of their tasks. The processing of personal data strictly necessary for fraud prevention purposes also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as being carried out for a legitimate interest.”
-
Recital 48 “Controllers that are part of a group of undertakings, or institutions affiliated with a central body, may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of personal data of clients or employees. The general principles for the transfer of personal data, within a group of undertakings, to an enterprise in a third country remain unaffected.”
-
Recital 49 “The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e., the ability of a network or an information system to withstand, at a given level of security, accidental or unlawful events that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal data, as well as the security of the related services offered or made accessible via these networks and systems, by public authorities, Computer Emergency Response Teams (CERT), Computer Security Incident Response Teams (CSIRT), providers of networks and electronic communication services, and providers of technology and security services, constitutes a legitimate interest of the data controller concerned. This could involve, for example, preventing unauthorized access to electronic communication networks and the distribution of malicious code, and stopping ‘denial of service’ attacks and damage to computer and electronic communication systems.”
FAQ
What is the legitimate interests test (LIA) under GDPR?
The Legitimate Interests Assessment (LIA) is a three-part test for Article 6(1)(f) GDPR: (1) Is the purpose a legitimate interest? (2) Is processing necessary for that purpose? (3) Do the individual’s rights and interests override the controller’s interest?
When can an organisation rely on legitimate interests as a legal basis?
Legitimate interests can be used when there is a genuine business purpose, no less privacy-invasive means exists to achieve it, and the impact on data subjects is proportionate. It cannot be used by public authorities for their public tasks.
What are examples of legitimate interests that typically pass the three-part test?
Fraud prevention and proportionate network security monitoring are candidates, not automatic approvals. Intra-group disclosures and product research also need a specific assessment. Electronic direct marketing must separately satisfy applicable ePrivacy rules, including consent or a valid national-law exception.
What must be documented when relying on legitimate interests?
A written LIA documenting: the specific legitimate interest pursued, why processing is necessary, the potential impact on data subjects, and why interests or freedoms do not override. This must be available on supervisory authority request.