What is legitimate interest in the GDPR?

Legitimate interests is a lawful basis under Article 6(1)(f) of the GDPR. It allows necessary processing for an organisation’s or a third party’s legitimate interests, provided individuals’ interests and fundamental rights do not override them. Fraud prevention and network security are common examples, but neither automatically qualifies.

Before relying on this basis, complete and document three checks:

• Purpose: Identify a specific, lawful and genuine interest.

• Necessity: Establish why the processing is needed and whether a less intrusive method could achieve the same result.

• Balancing: Assess the impact on individuals, their reasonable expectations and the safeguards available, giving particular attention to children.

Explain the interests you rely on in your privacy notice and review the assessment when circumstances change.

Individuals can object on grounds relating to their circumstances. You must then stop unless you demonstrate overriding compelling grounds or need the processing for legal claims. An objection to direct marketing is absolute: that marketing must stop.

Legitimate interests cannot bypass cookie consent requirements. It also does not replace the additional conditions for special-category data, and public authorities cannot use it when performing their public tasks.