What are legitimate interests?
Legitimate interests is a lawful basis that may permit processing when an organisation or third party has a genuine interest, the processing is necessary to achieve it and the individual’s interests, rights and freedoms do not override it. It requires a contextual balancing exercise rather than a simple business preference.
Potential interests can include fraud prevention, network security, certain direct marketing, service improvement or protection of legal rights, but an interest is not automatically legitimate in every context. The purpose, relationship and impact determine whether the basis is appropriate.
What is a legitimate interests assessment?
A legitimate interests assessment, often called an LIA, normally contains three parts. The purpose test identifies the specific interest. The necessity test asks whether the processing is a proportionate way to achieve it and whether a less intrusive alternative exists. The balancing test considers the impact on individuals.
The assessment should examine expectations, sensitivity, scale, vulnerability, transparency, safeguards and the consequences of processing. The reasoning should be documented before the activity begins.
How are interests balanced?
Processing is more likely to be acceptable when people reasonably expect it, the data is limited and the impact is small or reversible. Risk increases when the use is unexpected, intrusive, large-scale or involves vulnerable people, sensitive information or significant decisions.
Safeguards such as minimisation, opt-outs, short retention, access controls and pseudonymisation can affect the balance, but they should not be used to justify an activity whose core impact remains excessive.
What rights apply?
Individuals may have a right to object to processing based on legitimate interests. The organisation should have a process to assess the objection and determine whether compelling grounds or legal claims justify continuation. Direct-marketing objections may receive particularly strong protection under applicable law.
The privacy notice should clearly describe the interest rather than use a vague statement that legitimate interests may apply.
Frequently asked questions
Is every business interest legitimate?
No. The interest must be lawful, sufficiently specific and balanced against the effect on individuals.
Is an LIA legally required?
Documenting the assessment is a strong accountability practice and may be necessary to demonstrate that the basis was properly selected.
Can legitimate interests support profiling?
Potentially, but profiling may create greater impact and require deeper assessment, transparency, safeguards and respect for objections.
Can public authorities use legitimate interests?
Restrictions may apply when they perform official tasks. The appropriate basis should be assessed under the relevant law.
When should an LIA be reviewed?
Review is needed when purpose, data, scale, technology, affected people or expectations materially change.