How to Conduct a Legitimate Interest Assessment

A Legitimate Interest Assessment is the documented analysis you complete before relying on Article 6(1)(f) of the GDPR to process personal data, and conducting one means working through a three-part test — purpose, necessity, and balancing — with all three parts recorded in writing before processing begins.¹ The European Data Protection Board requires all three conditions to be met, and the accountability principle requires you to be able to show the reasoning if a regulator or data subject asks.² The rest of this guide walks through the assessment in the order you would actually complete it.

When You Need to Do One

Article 6(1)(f) allows you to process personal data when it is necessary for a legitimate interest pursued by your organization or a third party, provided that interest does not override the individual’s fundamental rights and freedoms.³ You reach for this basis when none of the other five options in Article 6 fit cleanly: the individual has not given consent, no contract requires the processing, and no law compels it, but you still have a genuine reason to handle the data.

Common activities in this territory include fraud prevention, direct marketing to existing customers, transferring employee or client data within a corporate group for administrative purposes, and network and information security.⁴⁵

One boundary matters up front: public authorities cannot rely on legitimate interest when processing data in the performance of their official tasks.³ Government bodies will typically need Article 6(1)(e) instead, which covers processing necessary for a task carried out in the public interest.

Gather the Facts First

Before you start the analytical part, write a factual description of the processing you are planning. Identify the categories of personal data involved (names, IP addresses, purchase histories, and so on), the groups of individuals affected (current customers, employees, website visitors), and where the data comes from — whether directly from the individual, from public records, or from a third-party vendor. Note retention periods and any plans to share the data.⁶

Most compliance teams use a standardized template with the date, the department responsible, and a plain-language description of the project. Filling in these factual fields first keeps the later analysis honest, because you are building your justification on specifics rather than vague intentions. If you have already completed a Data Protection Impact Assessment for the same activity, much of this information will already be compiled.

Step One: The Purpose Test

The purpose test asks what benefit you are trying to achieve and whether it counts as a legitimate interest. You need to articulate the purpose clearly and specifically. “Improving our services” is too vague. “Analyzing purchase patterns of existing customers to recommend related products” is the level of specificity regulators expect.⁷

The EDPB sets three criteria for what counts as a legitimate interest: it must be lawful (not contrary to EU or member state law), clearly and precisely articulated, and real and present rather than speculative.¹ A future, hypothetical benefit does not qualify. The interest can be commercial, social, or a broader public benefit; the regulation does not limit you to profit motives. Record which category applies and why.

Step Two: The Necessity Test

Once your purpose passes, ask whether processing personal data is genuinely necessary to achieve it. Many assessments fail here. Necessity under the GDPR is a higher bar than convenience: if you can reasonably achieve the same outcome through a less intrusive method that uses less personal data, your current plan does not meet the standard.¹

Document the alternatives you considered and explain why they would not work. Could you use anonymized or aggregated data? Could you limit the data fields to fewer categories? Is the volume proportionate to the goal?⁷ Recording this analysis forces genuine evaluation of proportionality and gives regulators evidence that you did not simply default to collecting everything available.

Step Three: The Balancing Test

The balancing test weighs your legitimate interest against the rights, freedoms, and interests of the individuals whose data you plan to process. Even if your purpose is legitimate and the processing is necessary, the individual’s interests can still override yours.⁷ The EDPB identifies four elements to work through:

The individual’s interests, rights, and freedoms. Consider what is at stake for the person, including possible discrimination, reputational damage, or financial loss.
The impact of the processing. Look at the nature of the data, the context in which it was collected, and any further consequences, including consequences the individual might not anticipate.
Reasonable expectations. Would the individual expect their data to be used this way, given their relationship with your organization? A customer who gave you their email at checkout has different expectations than someone whose data you obtained from a broker.
Mitigating measures. Document safeguards that reduce the impact, such as encryption, pseudonymization, strict access controls, or data-sharing agreements with usage limits.¹

Sensitive Data and Children’s Information

When the processing involves special category data (health information, racial or ethnic origin, political opinions, and similar categories), criminal offense data, or children’s information, the threshold for passing the balancing test rises sharply. The individual’s interests are more likely to override yours, and you should approach the analysis assuming that they do unless you have a compelling reason to conclude otherwise.⁸ Processing criminal offense data also requires a separate legal condition under Article 10 of the GDPR on top of meeting the legitimate interests requirements.

Weighing Safeguards

Listing your mitigating measures inside the assessment is part of the balancing exercise, not decoration. Safeguards can tip the balance in your favor. Technical measures like pseudonymization, data minimization protocols, and encryption reduce risk to individuals. Organizational measures like restricted access, staff training, and contractual limits on third-party data use show that you are actively managing the impact. If you introduce new safeguards later, the EDPB advises performing the balancing test again to see whether the balance has shifted.¹

When the Balance Tips Against You

Sometimes you finish the balancing test and the honest answer is that the individual’s rights override your interest. That is the process working correctly. You then have two options. First, introduce additional mitigating measures to reduce the impact on individuals, and rerun the balancing test. If the new safeguards bring the balance back in your favor, you can proceed. Second, if no reasonable safeguards change the outcome, you cannot rely on Article 6(1)(f) for that processing activity.¹

At that point, you either find another legal basis (consent is the most common fallback, though it carries its own requirements) or you do not process the data. Recording a negative outcome in your assessment is still valuable, because it shows regulators that your organization takes the analysis seriously rather than treating it as a formality.

Disclose the Interest in Your Privacy Notice

Relying on legitimate interest triggers a specific transparency obligation. When you collect personal data directly from an individual, Article 13 of the GDPR requires you to disclose the legitimate interest you are pursuing.⁹ A generic phrase like “we have a legitimate interest in using your data” is not enough. Name the specific purpose, for example: “we analyze purchase histories of existing customers to recommend related products.”

Transparency feeds back into the balancing test. A privacy notice that clearly explains what you intend to do with someone’s data makes it more likely that the person will have reasonable expectations about the processing, which strengthens your position. Burying the explanation in a long, impenetrable policy undermines any later claim that the processing was expected.⁸

Prepare for Objections

Even after a thorough assessment, any individual can object to your use of their data when you rely on legitimate interest. Under Article 21(1), the individual has the right to object at any time, and your organization must stop processing unless you can demonstrate compelling legitimate grounds that override the individual’s interests, rights, and freedoms.¹⁰ Your original assessment becomes the first line of defense; a well-documented balancing test gives you something concrete to point to when evaluating an objection.

For direct marketing, the right to object is absolute. When an individual objects to processing for marketing purposes, you must stop. There is no override, no further balancing, no exception.¹⁰ You are also required to inform individuals of their right to object at the latest by the time of your first communication with them, presented clearly and separately from other information.

Sign-Off, Storage, and Review

There is no single mandated format or approval process for a Legitimate Interest Assessment.⁷ Most organizations have a senior manager or Data Protection Officer review and sign off on each completed assessment as a matter of internal governance. That is good practice rather than a strict regulatory requirement, but it ensures someone with authority has accepted the reasoning and the associated risks.

Link the completed assessment to your Record of Processing Activities, the log of processing operations required by Article 30.¹¹ Store the assessment in a centralized, secure location where it can be retrieved quickly. Regulators can request these documents during an investigation, and the accountability principle requires you to demonstrate compliance, not merely assert it.² Processing data without a valid legal basis, including claiming legitimate interest without actually meeting the three-part test, can attract fines of up to €20 million or four percent of global annual turnover.¹²

An assessment is not a one-time exercise. If the nature of your processing changes, whether through new technology, additional data categories, new groups of individuals, or shifts in how people expect their data to be used, revisit the assessment and update it. Build a review schedule into your compliance calendar so assessments do not quietly become outdated.

How This Differs From a DPIA

The Legitimate Interest Assessment and the Data Protection Impact Assessment are often confused. An LIA is a lighter-touch analysis tied specifically to your choice of legal basis under Article 6(1)(f). A DPIA is a more comprehensive process required whenever your processing is likely to result in high risk to individuals’ rights and freedoms, regardless of which legal basis you use.⁷

A DPIA is mandatory in three situations: systematic and extensive automated profiling with significant effects on individuals, large-scale processing of special category or criminal offense data, and large-scale systematic monitoring of publicly accessible areas.¹³ An LIA can itself trigger a DPIA: if your balancing test reveals high risks to individuals, you likely need the more detailed assessment as well. You can build on an existing LIA to create your DPIA, or use a DPIA in place of a standalone LIA, since the DPIA covers the same ground in greater depth.

1
European Data Protection Board. Guidelines 1/2024 on Processing of Personal Data Based on Article 6(1)(f) GDPR
2
GDPR-Info.eu. General Data Protection Regulation Art 5 – Principles Relating to Processing of Personal Data
3
GDPR-Info.eu. General Data Protection Regulation Art 6 – Lawfulness of Processing
4
GDPR-Info.eu. GDPR Recital 47 – Overriding Legitimate Interest
5
GDPR.eu. GDPR Recital 48 – Overriding Legitimate Interest Within Group of Undertakings
6
IAB Europe. IAB Europe GDPR Guidance Legitimate Interests Assessments LIA for Digital Advertising
7
Information Commissioner’s Office. How to Apply Legitimate Interests in Practice
8
Information Commissioner’s Office. What Is the Legitimate Interests Basis
9
GDPR-Info.eu. General Data Protection Regulation Art 13 – Information to Be Provided Where Personal Data Are Collected
10
GDPR-Info.eu. General Data Protection Regulation Art 21 – Right to Object
11
GDPR-Info.eu. General Data Protection Regulation Art 30 – Records of Processing Activities
12
GDPR-Info.eu. General Data Protection Regulation Art 83 – General Conditions for Imposing Administrative Fines
13
Information Commissioner’s Office. When Do We Need to Do a DPIA