Legitimate Interests Assessment: The Test and the Trap

A legitimate interests assessment is what makes Article 6(1)(f) usable. The Regulation never uses the phrase — but Recital 47 says the existence of a legitimate interest “would need careful assessment”, and the LIA is that assessment written down.

It is also the lawful basis people reach for when consent looks inconvenient, without noticing that it comes with an obligation consent does not: the right to object.

What Article 6(1)(f) says

Article 6(1)(f) makes processing lawful where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data — in particular where the data subject is a child.

Three things are doing work in that sentence, and they are the three parts of a legitimate interests assessment.

A legitimate interest, which may be yours or a third party’s. Recital 47 names two examples outright: processing strictly necessary for preventing fraud is a legitimate interest, and processing for direct marketing purposes may be regarded as one.

Necessity. The word is “necessary for the purposes of”, not “useful for”. If a less intrusive route achieves the same purpose, the processing is not necessary.

Balancing, in which the data subject’s interests and fundamental rights can override yours — with the Regulation flagging children specifically.

Who cannot rely on a legitimate interests assessment

One exclusion is absolute and easy to miss because it sits in an unnumbered subparagraph: point (f) shall not apply to processing carried out by public authorities in the performance of their tasks.

Recital 47 explains why — it is for the legislator to provide the legal basis for public authorities. If you are a public authority processing in the performance of your tasks, no legitimate interests assessment can rescue the basis. You need a different one.

The legitimate interests assessment test

Recital 47 supplies the standard the balancing turns on: the reasonable expectations of data subjects based on their relationship with the controller.

It gives the positive case — a legitimate interest could exist where there is a “relevant and appropriate relationship”, such as where the data subject is a client of, or in the service of, the controller. And it gives the negative case plainly: the data subject’s interests could in particular override the controller’s where data are processed in circumstances where data subjects do not reasonably expect further processing.

So the decisive question in most legitimate interests assessments is not “is our interest legitimate?” — it usually is. It is: would this person, at the point of collection, have expected this? Recital 47 ties the test to the time and context of collection, which is why repurposing data collected years ago for a new use is where legitimate interests most often fails.

The obligation a legitimate interests assessment brings with it

Choosing legitimate interests hands the data subject Article 21, and it changes the burden of proof.

Under Article 21(1), a person may object at any time on grounds relating to their particular situation to processing based on Article 6(1)(e) or (f), including profiling. The controller must then stop, unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing is for the establishment, exercise or defence of legal claims.

Read the shift carefully. Before an objection you balanced interests. After one you must show compelling grounds that override. That is a higher bar, and it is a bar you have to clear per objection.

A legitimate interests assessment that concluded “on balance, proceed” is not an answer to an Article 21 objection. If your assessment never contemplated what a compelling ground would look like, you will be improvising under a deadline.

Direct marketing is the trap

Recital 47 says direct marketing may be regarded as carried out for a legitimate interest. Marketing teams stop reading there.

Article 21(2) gives the data subject the right to object at any time to processing for direct marketing, including profiling related to it. And Article 21(3) is unconditional: where the data subject objects, the personal data shall no longer be processed for such purposes.

There is no balancing. No compelling grounds exception. The objection simply wins.

So legitimate interests earns you the right to start marketing to someone; it never earns the right to continue once they say no. Any legitimate interests assessment covering direct marketing should say so explicitly, and the opt-out mechanism is part of the measures that make the balance defensible in the first place.

How the legitimate interests assessment connects to your records

Where to start with a legitimate interests assessment

1. Check you are eligible. Public authorities processing in the performance of their tasks cannot use this basis.
2. State the interest concretely, and say whose it is — yours or a third party’s.
3. Test necessity against a less intrusive alternative, and record why it was rejected.
4. Balance against reasonable expectations at the point of collection, not against your own view of the risk.
5. Give extra weight where children are involved, as Article 6(1)(f) requires.
6. Write down what a compelling ground would be, before the first Article 21 objection arrives — and accept that for direct marketing there is none.

This guide reflects Regulation (EU) 2016/679 as published on EUR-Lex, read at 16 August 2026.

The GDPR Toolkit provides 100+ editable templates including the legitimate interests assessment, the records of processing, the DPIA template and the data subject rights procedures covering objections.