A flexible lawful basis for processing that is necessary for a genuine interest, balanced against the individual's rights.
Legitimate interests can justify processing that is necessary for a genuine (business or third-party) interest, provided that interest is not overridden by the individual's rights and freedoms.
Using it requires a three-part 'legitimate interest assessment' (LIA): identify the interest, show the processing is necessary, and balance it against the impact on the data subject.
In the Regulation
Related terms
Lawful basisOne of the six legal grounds in Article 6 that every act of processing must rely on.Legitimate interest assessmentThe documented three-part test (purpose, necessity, balancing) you run before relying on legitimate interests.ConsentA freely given, specific, informed and unambiguous agreement to processing — and one of the six lawful bases.
Need this applied to your business?
Our data-protection lawyers turn GDPR terms into a working plan.