Legitimate interest is a legal basis under GDPR that allows processing personal data without consent, if your interest is not overridden by the person's rights. It is set out in Article 6(1)(f) GDPR. To rely on it, you must pass three cumulative tests: you pursue a genuine, lawful interest; the processing is necessary for that interest; and, after balancing, the person's interests and rights do not override it. It is the most flexible legal basis, and the one that needs the most careful documentation.
An everyday example
"Example Accountants Ltd" (a made-up example) wants to send its existing business clients a short newsletter about tax changes, and to log access to its client portal to detect break-in attempts.
For the newsletter, the firm's interest is keeping clients informed about relevant services. It only uses names and email addresses it already holds, clients would reasonably expect to hear about tax changes from their accountant, and every email has an unsubscribe link. For the access logs, preventing fraud and keeping the portal secure is a clear interest, and the logs are limited and kept for a short time. Both pass the test, and the firm writes each assessment down in a page.
(Electronic marketing also has to meet the separate ePrivacy rules in your country, which GDPR does not replace.)
The details, simply
The rule (Art. 6(1)(f))
Processing is lawful if it is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject", in particular where the person is a child.
It is one of six legal bases in Article 6, alongside consent, contract, legal obligation, vital interests and public task. Public authorities cannot use it for processing in the performance of their tasks.
The three-part test
The European Data Protection Board sets out the three cumulative conditions in its Guidelines 1/2024 on processing based on Article 6(1)(f) (version 1.0 adopted 8 October 2024 for public consultation):
1. Purpose test: is there a legitimate interest? The interest must be lawful, clearly and precisely articulated, and real and present, not speculative. Commercial interests can qualify: the Court of Justice confirmed in October 2024 (C-621/22, Koninklijke Nederlandse Lawn Tennisbond) that a commercial interest can be a legitimate interest, as long as it is not contrary to law.
2. Necessity test: is the processing necessary? The processing must actually help achieve the interest, and there must be no reasonable, less intrusive way to achieve it. Necessity goes hand in hand with data minimisation: if you can do it with less data, you must.
3. Balancing test: do the person's rights override your interest? Weigh your interest against the impact on the people concerned. Consider:
- the nature of the data (sensitive data weighs heavily);
- the reasonable expectations of the person, given their relationship with you;
- the possible consequences for them, positive and negative;
- safeguards you add, such as short retention, pseudonymisation or an easy opt-out.
Recital 47 says the person's interests can override yours in particular where they would not reasonably expect the processing.
Typical examples
Recitals 47 and 49 GDPR mention:
- fraud prevention, to the extent strictly necessary;
- direct marketing, which "may be regarded" as a legitimate interest;
- network and information security.
Other common uses include internal administrative transfers within a corporate group and many everyday B2B contact data uses. Each still needs its own three-part test.
Write it down: the LIA
The assessment is usually documented as a legitimate interests assessment (LIA), done before processing starts. Accountability (Art. 5(2)) means you must be able to show it. People also have a right to object to processing based on legitimate interest (Art. 21), and you must stop unless you show compelling grounds that override theirs. For direct marketing, the objection is absolute.
Why it does not cover special category data
Legitimate interest is an Article 6 basis. Special category data, such as health, genetic or biometric data, is also subject to the prohibition in Article 9, and the exceptions in Art. 9(2) do not include legitimate interest. So a practice cannot process patient data "because we have a legitimate interest in it". It needs an Art. 6 basis and an Art. 9 exception, such as the health care exception or explicit consent. See special category data.
This is general information, not legal advice.
What legitimate interest does not protect
The balancing test protects identifiable people. Like the rest of GDPR, it stops at anonymous data (Recital 26). Once data has been anonymised, no legal basis is needed at all, no balancing, no objection right.
That creates an awkward pattern. "Product improvement" and "developing new services" are often presented as legitimate interests. Combined with a step that anonymises or "de-identifies" the data, they can turn your uploads into material the provider may lawfully reuse, license or sell, with no consent and no objection right. The EDPB looked at legitimate interest for developing AI models in its Opinion 28/2024 and stressed that it depends on necessity and a careful balancing in each case. See how the reuse path works on the data trail.
What this means when you use AI tools
When an AI provider relies on legitimate interest for anything beyond running the service for you, ask:
- Whose interest? Is the provider processing for you, as your processor, or for its own purposes as a controller?
- Which purposes? Look for "service improvement", "research" or "training" in the privacy policy.
- Can you object, and does it stick? Opt-outs for training should be clear and contractual.
- Anonymisation rights: do the terms allow the provider to create anonymised or aggregated data from your content?
- Your own basis: as controller, you need your own legal basis, plus an Art. 9 exception for health data.
Wysor does not need legitimate interest for your content, because it does not use your content for its own purposes. We act only as your processor under Art. 28 GDPR, on your instructions, take no licence to reuse your content, and never train on it or sell it, anonymised or not. Those commitments are in the contract and bind anyone who could ever own Wysor. Data is encrypted in transit and at rest, hosted in the EU, and every connected AI model provider runs with zero data retention.
FAQ
What is legitimate interest in GDPR? It is the legal basis in Article 6(1)(f) GDPR that allows processing personal data where it is necessary for a legitimate interest of the controller or a third party, and the person's rights do not override that interest.
What is the three-part test for legitimate interest? Purpose (is there a lawful, clearly defined interest?), necessity (is the processing needed, with no less intrusive way?) and balancing (do the person's interests and rights override yours?). All three must be met.
Can you use legitimate interest for marketing? Often yes for direct marketing, as Recital 47 says it "may be regarded" as a legitimate interest. People can always object, and electronic marketing must also comply with national ePrivacy rules.
Can legitimate interest be used for health data? Not on its own. Health data is special category data, so you also need an exception under Article 9(2), and legitimate interest is not one of them.
Is legitimate interest better than consent? Neither is better in general. Legitimate interest suits processing people would reasonably expect with low impact; consent suits processing that depends on a free choice. The EDPB warns against treating legitimate interest as a default or a last resort.
Further reading
- What is GDPR? A simple explanation
- What is a DPIA? Data protection impact assessments explained simply
- What is a data processing agreement (DPA)?
- GDPR fines: how much, for what, and how they are calculated
Questions about legal bases for AI at work? Reach us at [email protected] or through the in-app contact form.
