Legitimate interests under the GDPR: when you can rely on it and how to document it

Article 6(1)(f) allows processing that is necessary for the legitimate interests of the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the individual, in particular where the individual is a child.

The three-part test

• Purpose: is there a legitimate interest? It must be lawful, clearly stated and real, such as fraud prevention, network security or direct marketing to existing customers.
• Necessity: is the processing necessary for that purpose, or could you achieve it with less data or in a less intrusive way?
• Balancing: do the individual's interests, rights and reasonable expectations override yours? Consider the nature of the data, how the individual would expect it to be used, and any safeguards you apply.

Write it down

The GDPR's accountability principle (Art. 5(2)) means you must be able to show that you carried out the test. A short legitimate interests assessment per activity is enough: the interest, why the processing is necessary, the balancing and the safeguards.

Tell people and let them object

Your privacy notice must state the legitimate interests you rely on (Art. 13(1)(d)). Individuals have the right to object; for direct marketing the objection is absolute and processing must stop (Art. 21(2)-(3)).

When it does not work

Our GDPR assessment asks which activities rely on legitimate interests and produces a pre-filled assessment template for each.

• Public authorities cannot rely on it for their tasks.
• Cookies and similar tracking for analytics or advertising generally require consent under ePrivacy rules, whatever the GDPR basis.
• Special categories of data need a condition under Article 9 in addition to a legal basis.