Legitimate interest is the legal basis businesses most often cite incorrectly. The misunderstanding is consistent: operators see it as a catch-all that avoids the inconvenience of consent banners and tick boxes. Supervisory authorities see it differently. The basis is valid — but only when a genuine three-part test is satisfied and documented.
The Six Lawful Bases Under GDPR Article 6
GDPR Article 6(1) lists six lawful bases. Processing personal data without one of them is unlawful. Understanding all six matters because legitimate interest is a last resort, not a first choice — and the correct basis for a given activity may be a different one entirely.
| Legal Basis | When It Applies | Typical Use Case |
|---|---|---|
| Consent (Art. 6(1)(a)) | Data subject freely, specifically, and unambiguously opts in | Marketing emails to new subscribers, advertising cookies |
| Contract (Art. 6(1)(b)) | Processing necessary to perform or enter a contract | Order fulfilment, billing, account management |
| Legal obligation (Art. 6(1)(c)) | Processing required by EU or member state law | Tax records, employment records, AML/KYC checks |
| Vital interests (Art. 6(1)(d)) | Processing necessary to protect life | Medical emergency data sharing |
| Public task (Art. 6(1)(e)) | Processing by public authorities in official capacity | Government data processing, public health surveillance |
| Legitimate interest (Art. 6(1)(f)) | Controller's or third party's interest, not overridden by data subject's rights | Fraud prevention, network security, direct marketing to existing customers |
The principle of purpose limitation means you cannot switch legal bases retroactively. If you collect data under consent and the consent is later withdrawn, you cannot simply switch to legitimate interest to keep processing.
The Three-Part Legitimate Interest Test
The EDPB and ICO both describe legitimate interest as requiring a three-part analysis. All three parts must be satisfied.
Part 1: Purpose Test — Is the Interest Legitimate?
The interest must be real, lawful, and clearly articulated. Vague or self-serving purposes fail this test. "We want to understand our users better" is not a legitimate interest. "We monitor login attempts to detect and prevent unauthorised account access" is.
Interests recognised in GDPR itself and by the EDPB include:
- Fraud prevention (explicitly named in Recital 47)
- Direct marketing to existing customers (Recital 47)
- Intra-group data transfers for administrative purposes (Recital 48)
- Network and information security (Recital 49)
- Reporting criminal acts to competent authorities
Part 2: Necessity Test — Is Processing Necessary?
Processing must be necessary to achieve the identified interest. If a less intrusive means would achieve the same goal, legitimate interest does not apply. You must consider whether anonymisation, pseudonymisation, or data minimisation could achieve the purpose without processing identifiable personal data.
Example: If your goal is to detect bot traffic on your website, analysing request patterns by IP address is likely necessary. Building a persistent behavioural profile of every individual user is not necessary for that purpose.
Part 3: Balancing Test — Do the Individual's Rights Override Your Interest?
This is the test businesses most often skip. You must genuinely weigh the data subject's reasonable expectations, the nature of the data, the impact of processing, and any safeguards against your interest.
Factors that tip the balance toward the individual:
- The data subject is unlikely to expect this processing
- The data is sensitive, financial, or concerns children
- The processing has a significant impact (financial, reputational, physical)
- Large volumes of data about many individuals
- Data is shared with third parties or used for profiling
Factors that tip the balance toward the controller:
- Processing is clearly in the data subject's interest too (e.g., security monitoring)
- The data subject has a prior relationship with the controller
- Strong technical safeguards are applied (encryption, access controls, retention limits)
- Data is anonymised or aggregated before use
Valid vs Invalid Uses of Legitimate Interest
| Use Case | Valid LI? | If Not, Correct Basis | Documentation Needed |
|---|---|---|---|
| Fraud prevention and security monitoring | Yes | N/A | LIA documenting security interest, measures, and proportionality |
| Direct marketing to existing customers (similar products) | Yes (narrow) | Consent for new contacts | LIA, opt-out at collection, easy unsubscribe |
| Employee monitoring for legitimate business purposes (timesheets) | Yes (limited) | Contract for basic HR data | LIA, proportionality assessment, employee notice |
| Tracking website visitors for behavioural advertising | No | Consent | Cannot rely on LI — use cookie consent banner |
| Building demographic/behavioural profiles for ad targeting | No | Consent | Cannot rely on LI — EDPB guidelines confirm this |
| Selling data to third-party data brokers | No | None — likely unlawful | Cannot be legitimised under any standard basis |
| Analytics with full anonymisation (no identifiers retained) | Not required | N/A — not personal data | Document anonymisation method to confirm scope |
| Sending transactional emails (receipts, shipping) | No — contract applies | Contract performance | N/A — use correct basis |
How Meta Got It Wrong
Meta's reliance on legitimate interest — and later on contractual necessity — to process personal data for behavioural advertising was repeatedly challenged by the NOYB (None of Your Business) organisation and referred to the EDPB. The EDPB's binding decision, resulting in the Irish DPC's May 2023 fine of €1.2 billion, established that Meta could not rely on either contract performance or legitimate interest for advertising-related processing. The processing lacked genuine necessity for contract performance, and the balancing test for legitimate interest was clearly not satisfied given the scale, sensitivity, and lack of user expectation.
LinkedIn's use of targeted advertising based on legitimate interest was challenged in a CJEU reference. The court's analysis reinforced that legitimate interest for advertising purposes requires a genuine balancing test — not a self-serving assertion of business necessity.
Documenting Legitimate Interest in Your Privacy Policy
Your privacy policy must, per Articles 13 and 14:
- Identify legitimate interest as the legal basis
- Name the specific interest being pursued (not just "our legitimate interest")
- Inform data subjects of their right to object under Article 21
- Explain how to exercise that right (typically via a contact email or preference centre)
Non-compliant wording: "We may process your data based on our legitimate interests."
Compliant wording: "We analyse login activity and unusual account access patterns based on our legitimate interest in preventing unauthorised access and fraud (Article 6(1)(f) GDPR). You have the right to object to this processing at any time by contacting [email]. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests."
Generate a privacy policy that correctly documents your legal bases — including a properly scoped legitimate interest clause — at /gdpr-privacy-policy-generator.