Legitimate interest is the legal basis in Article 6(1)(f) of the GDPR that permits processing of personal data when it is necessary for a genuine interest of the controller or a third party, and when that interest is not overridden by the rights and freedoms of the data subject. It is the most flexible of the six lawful bases, and for that reason it is also the one that demands the most documented reasoning from the controller.
Unlike consent, legitimate interest does not ask the individual for permission. Instead, the controller carries the burden of justification under the accountability principle and must be able to show, at any time, why the processing is fair. In GDPR practice it covers activities such as fraud prevention, network and information security, internal administration and, in many cases, direct marketing to existing customers.
How the three-part legitimate interest test works
Legitimate interest is established through a three-part test that the Court of Justice of the European Union has confirmed as cumulative conditions. All three parts must be satisfied; failing any one of them means the controller must find another legal basis or stop the processing.
The following table summarizes each stage of the assessment, the question it answers and the evidence a controller typically records.
| Stage | Question answered | Typical evidence |
|---|---|---|
| Purpose test | Is there a lawful, real and present interest? | Description of the business, legal or societal interest |
| Necessity test | Is the processing needed to achieve that interest? | Analysis of less intrusive alternatives and data minimization |
| Balancing test | Do the individual’s rights override the interest? | Impact analysis, reasonable expectations, safeguards |
The purpose test is relatively easy to pass: commercial interests can be legitimate, provided they are lawful, clearly articulated and not speculative. The necessity test is stricter, because processing that could reasonably be achieved with less data or a less intrusive method is not necessary in the legal sense. The balancing test is where most assessments succeed or fail, since it weighs the controller’s interest against the concrete impact on the people concerned.
The written result of this exercise is called a legitimate interest assessment (LIA). The GDPR does not prescribe its format, but supervisory authorities expect it to exist before processing begins and to be reviewed when the purpose, data or context changes.
Factors that decide the balancing test
The balancing test is decided by the nature of the data, the reasonable expectations of the individuals and the safeguards the controller applies. Recital 47 of the GDPR points to the relationship between the controller and the data subject as a key indicator: a customer expects some processing by a company they buy from, while a stranger usually does not.
| Factor | Tips the balance toward the controller | Tips the balance toward the individual |
|---|---|---|
| Relationship | Existing customer or employee | No prior relationship |
| Data category | Contact or transaction data | Special category, location or financial data |
| Data subject | Adults acting professionally | Children or vulnerable persons |
| Scale | Limited data set, short retention | Large-scale profiling or combination of sources |
| Transparency | Clear notice and easy opt-out | Hidden or unexpected processing |
| Safeguards | Pseudonymization, access limits, deletion schedule | Broad sharing with third parties |
Interests of children carry particular weight, as Article 6(1)(f) states explicitly. Processing that is unexpected, intrusive or difficult to escape rarely survives the balancing stage, however valuable it may be to the business. Strong safeguards can shift a borderline case, but they cannot rescue processing that individuals would objectively not anticipate.
Legitimate interest compared with other legal bases
Legitimate interest differs from the other lawful bases because the controller, not the individual or the law, decides whether the condition is met. This gives flexibility, but it also exposes the controller to challenge if the reasoning is weak. The comparison below shows how it sits next to the bases most often confused with it.
| Legal basis | Who justifies it | Individual’s main control | Typical use |
|---|---|---|---|
| Legitimate interest | Controller through an LIA | Right to object under Article 21 | Fraud checks, security logs, B2B outreach |
| Consent | Individual through a clear choice | Withdrawal at any time | Optional marketing, non-essential cookies |
| Contract | Necessity for a contract | Limited while the contract runs | Order fulfillment, account management |
| Legal obligation | A specific legal rule | Very limited | Tax records, anti-money laundering checks |
A frequent error is switching bases after the fact. If consent was requested and then refused or withdrawn, a controller cannot quietly fall back on legitimate interest for the same purpose. The legal basis must be chosen and communicated in advance, and Article 13 requires the privacy notice to describe the specific legitimate interests pursued.
Legitimate interest is not available to public authorities for processing carried out in the performance of their tasks; they must rely on public task or legal obligation instead. Special category data under Article 9 also cannot rest on legitimate interest alone, because it requires an additional Article 9 condition.
Typical uses and the right to object
Legitimate interest is best suited to processing that is expected, proportionate and low in impact. The recitals of the GDPR name several examples directly, which gives controllers a reliable starting point.
- Fraud prevention, recognized in Recital 47 as a legitimate interest.
- Network and information security, including log analysis and intrusion detection, under Recital 49.
- Intra-group transfers for internal administrative purposes, mentioned in Recital 48.
- Direct marketing to existing customers, which Recital 47 states may be regarded as a legitimate interest.
- Physical security measures such as access control, provided retention and scope are limited.
Every processing operation based on legitimate interest triggers the right to object in Article 21. For general processing, the controller must stop unless it shows compelling legitimate grounds that override the individual’s interests. For direct marketing, the right is absolute: once a person objects, marketing use of their data must end without any balancing.
Legitimate interest under the GDPR also does not replace the separate rules of the ePrivacy Directive. Storing or reading information on a user’s device, such as non-essential cookies, still requires consent, and electronic marketing messages are governed by national rules that may require prior opt-in consent regardless of the GDPR basis.
Common mistakes when relying on legitimate interest
Most enforcement problems with legitimate interest come from treating it as a default rather than a reasoned conclusion. The table below lists recurring mistakes, their consequences and the corrective step.
| Mistake | Consequence | Correction |
|---|---|---|
| No written assessment | Controller cannot demonstrate compliance | Complete and date an LIA before processing |
| Vague interest such as business purposes | Purpose test fails on transparency | State the specific interest in the notice |
| Behavioral advertising across services | Balancing usually favors the individual | Use consent for intrusive profiling |
| Ignoring objections | Breach of Article 21 | Build an objection workflow with deadlines |
| One assessment for many purposes | Weak, generic reasoning | Assess each purpose separately |
The Court of Justice has held that extensive personalized advertising based on combining data from many sources generally cannot be justified by legitimate interest, because users do not reasonably expect it. The same reasoning applies to covert monitoring of employees. As a rule, the more a practice resembles surveillance, the less likely legitimate interest is to hold.
In plain words
Legitimate interest means an organization may use personal information without asking first, but only when it has a good, honest reason that people would reasonably expect, and only if the use does not harm them more than it helps the organization.
Think of a shop that keeps a record of a card payment that looked suspicious. Customers do not need to agree to that, because protecting them and the shop against fraud is sensible and expected. The organization must still write down its reasoning, tell people about it, and stop when someone objects unless it has a very strong reason to continue. For marketing, an objection always wins.
A real-world example
A mid-sized online retailer wants to analyze login events to block account takeover attacks. It records IP addresses, device types and timestamps for each login. The privacy team runs a legitimate interest assessment: the purpose is protecting customer accounts, the processing is necessary because no less intrusive method detects credential stuffing reliably, and customers reasonably expect security monitoring.
To keep the balance in the customers’ favor, the retailer limits retention of the logs to 90 days, restricts access to the security team and states the interest clearly in its privacy notice. The same retailer considers using the data to build advertising profiles but concludes that this purpose would fail the balancing test, so it asks for consent instead. The outcome is a documented, defensible basis for security processing and a clear separation from marketing use.