What are legitimate interests, and when do you need an assessment?

What it is

The test has three parts: a purpose test (is there a legitimate interest?), a necessity test (is the processing necessary for it?) and a balancing test (do the person's interests override it?). The UK GDPR gives direct marketing, sharing within a group for internal administration and network security as examples of processing that may be necessary for legitimate interests. Recognised legitimate interests, added by the DUAA from 2026-02-05, cover purposes in Annex 1 such as safeguarding, emergencies and crime prevention, with no balancing test.

When to use it and assess it

• When no more specific basis fits and the processing is something people would reasonably expect. Art 6(1)(f)
• An LIA should be done and kept whenever you rely on Art 6(1)(f): it is how you meet accountability for the choice. Art 5(2); Art 6(1)(f)
• For an Annex 1 purpose, you rely on Art 6(1)(ea) and record the condition instead of a balance. Art 6(1)(ea); Annex 1

When it is not available

• Public authorities processing in performance of their tasks. Art 6(1)
• Where the processing would be unexpected or cause unjustified harm, the balance usually fails.

Who is responsible

The controller, which must carry out and record the assessment and tell people in its privacy notice what interests it relies on. People can object, and the controller must then stop unless it has compelling grounds.

What it involves

1. Identify the interest.
2. Show the processing is necessary for it.
3. Weigh the impact on people, their expectations and safeguards.
4. Record the LIA and review it when things change.
5. Tell people, and handle objections under Art 21.

If it goes wrong

Regulatory

If the test fails, there is no lawful basis. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change.

Criminal

No offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.