Legitimate Interest

“An interest is not legitimate because an organisation finds the processing useful. ”

Legitimate interest is sometimes treated as the flexible option in data protection. Consent is inconvenient, a contract does not apply and no law requires the processing, so the organisation records legitimate interest and continues. That reverses the test. Article 6(1)(f) of the General Data Protection Regulation provides a legal basis only when several cumulative conditions are met.

The interest must first be legitimate. It should be lawful, sufficiently precise and real at the time of processing rather than speculative. Preventing fraud, securing a network or maintaining a limited business relationship may qualify. Collecting broad personal data because analysis might reveal future commercial value is not a clearly articulated interest.

Second, the processing must be necessary for that interest. Necessary does not mean helpful or efficient.

The organisation should examine whether the purpose can be achieved just as effectively through less intrusive means. Duplicate-farmer detection might be possible using a protected identifier and limited matching rather than distributing names, phone numbers and full identity documents across clients.

Third, the controller must balance the interest against the interests, fundamental rights and freedoms of the data subject. The nature of the data, context, reasonable expectations, relationship, scale, consequences and safeguards all matter. Children and people in dependent relationships require particular care.

The European Data Protection Board's Guidelines 1/2024 describe this three-step assessment and warn that legitimate interest is neither a last resort nor a basis to be chosen automatically because it appears less constraining.

The assessment should occur before processing and should be documented. Reasonable expectation is contextual. A farmer who gives a phone number for delivery coordination may reasonably expect messages about the transaction. They may not expect the number to be used for unrelated profiling or shared with other buyers. A privacy notice can inform people, but notice alone does not make an unexpected use fair.

Safeguards can affect the balance. Pseudonymisation, limited access, short retention, opt-out, human review and restricted purpose may reduce risk. They do not remove the need to establish a legitimate interest and necessity. A well-secured processing activity can still be unjustified. Transparency is required. Where processing relies on legitimate interests, people should be told what interests are pursued.

They may also have a right to object, particularly in relation to direct marketing and processing based on their particular situation. An objection process hidden in a long notice weakens practical control. The assessment should not bundle purposes. Fraud detection, product improvement, marketing and research may require different necessity and balancing analysis.

One broad statement that processing supports operational efficiency does not establish a legal basis for every use. Power again matters. A producer may have limited ability to avoid a buyer's data ecosystem. An organisation should not interpret continued participation as acceptance of any use it considers legitimate.

The balancing test should examine real consequences, including exclusion, price effects, surveillance and loss of bargaining power. The discipline is to write the argument as though an affected person and regulator will read it.

What exact interest is pursued? Why is this processing necessary? What impact can it have? Which less intrusive alternatives were considered? Which safeguards and rights make the balance fair? If the answers are generic, the basis is not yet established.

Practical application

Complete a purpose-specific legitimate-interest assessment before processing. Define the interest, test necessity, identify affected groups and consequences, document reasonable expectations and compare less intrusive alternatives. Separate different purposes. Apply safeguards and provide clear notice, objection routes and review. Reassess when scale, data, technology, recipients or consequences change.

Escalate high-risk processing to a DPIA rather than treating the balancing test as sufficient.

Why it matters

Legitimate interest allows socially and operationally useful processing where consent or another basis is unsuitable. Its flexibility depends on disciplined necessity and balancing; without them, organisational convenience displaces individual rights.

Common misconception

Legitimate interest is often treated as permission whenever the organisation has a reasonable business purpose. The interest must be lawful, precise and present, the processing necessary, and the balance favourable after considering rights, expectations and safeguards.

Connections

Consent is a different legal basis and should not be manufactured where choice is absent. Data Minimisation applies regardless of the basis. Pseudonymisation may reduce risk, and a DPIA may be required where processing is likely to create high risk.

A question worth asking

If the people whose data you use could challenge your legitimate-interest assessment line by line, which claim of necessity or fairness would be least convincing?

Selected references

European Union. 2016. Regulation (EU) 2016/679, Article 6(1)(f), Recitals 47-49 and Article 21. European Data Protection Board. 2024. Guidelines 1/2024 on Processing of Personal Data Based on Article 6(1)(f) GDPR, Version 1. 0 for Public Consultation. Court of Justice of the European Union. 2024. Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens, Case C-621/22. European Data Protection Board.

2026. One-Stop-Shop Case Digest on the Legal Basis of Legitimate Interest. OECD. 2013. Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data.