Legitimate interests

Legitimate interest is not a general permission to use personal data. It may belong to the controller or to a third party and must serve a concrete, legally recognisable purpose. Processing under Article 6(1)(f) GDPR requires three questions: does a legitimate interest exist, is the processing necessary for it and do the interests or fundamental rights of the data subject override it? This assessment is commonly called the balancing test.

The assessment takes account of the context of the processing, the relationship with the organisation, the data subject’s reasonable expectations and available safeguards. Legitimate interests may be relevant, for example, to information security, fraud prevention or limited business communication. They do not automatically justify every data set, retention period or tracking practice. Processing special categories of personal data additionally requires a suitable exception under Article 9 GDPR.

Businesses should document the purpose, data involved, necessity, reasonable expectations, risks to data subjects and safeguards before processing starts. If the purpose or technical operation changes, the assessment must be revisited. Public authorities generally cannot rely on this legal basis when performing their tasks. The privacy compliance and governance topic helps with the organisational framework; cookies and tracking require a separate review of the specific processing purpose.