Privacy
Legitimate Interest
A legal basis for processing data when the controller's interest outweighs the data subject's rights.
Legitimate interest is one of the six legal bases for processing personal data under the GDPR. It allows processing when the data controller has a genuine reason that does not override the fundamental rights of the data subject.
The Three-Part Test
Before relying on legitimate interest, controllers must conduct a balancing test:
- Purpose test — Is there a legitimate interest? (e.g. fraud prevention, security, direct marketing)
- Necessity test — Is the processing necessary for that interest? Could a less intrusive alternative achieve the same goal?
- Balancing test — Do the data subject's interests, rights, or freedoms override the legitimate interest?
Common Examples
- Preventing fraud and ensuring network security
- Direct marketing to existing customers (with opt-out)
- Internal administration and record-keeping
- Processing for employment purposes
When NOT to Use Legitimate Interest
- When consent is more appropriate (e.g. cookies, marketing to new contacts)
- When there is a significant power imbalance (e.g. employer–employee in some contexts)
- When processing sensitive data (requires explicit consent or another specific basis)
Legal Reference
GDPR Article 6(1)(f). Recital 47 provides guidance on reasonable expectations.