This free legitimate interests assessment template walks you through the three-part test that Article 6(1)(f) of the GDPR sets: is there a legitimate interest, is the processing necessary for it, and do the interests, rights and freedoms of the people concerned override it? Instead of a blank form, it asks the questions in turn, checks your answers as you go and tells you what a regulator would still ask for.
Start by screening whether legitimate interests is available at all, then set out the purpose, test necessity and balance, weigh the impact on the people concerned from a library of 25 scenarios, choose the safeguards that tip the balance and record your conclusion. It follows the EDPB Guidelines 1/2024 on legitimate interest and the ICO’s legitimate interests guidance, and covers both the EU GDPR and the UK GDPR. It is free, and your answers save as you go.
Premium report
See what the premium legitimate interests assessment report looks like
A worked LIA for a fictional organization: the screening, the purpose test, the necessity and balancing tests, every impact on the people concerned with its safeguards and GDPR references, the data protection advice and conclusion, every finding with what closes it, an AI-assisted analysis with a 30/60/90-day roadmap, plus the live Excel workbook.
Other free risk assessments: Information Security Risk Assessment (ISO 27001) Privacy Risk Assessment (ISO 27701) Business Continuity Risk Assessment (ISO 22301) Enterprise Risk Assessment (ISO 31000) AI Risk Assessment (ISO 42001) Data Protection Impact Assessment (GDPR) Transfer Impact Assessment (GDPR) AI System Impact Assessment (ISO 42005) Third-Party Risk Assessment (ISO 27001)
What this legitimate interests assessment template covers
- Screening. Whether legitimate interests is available: public authorities performing their tasks cannot use it, other rules may require consent, a contract or legal obligation may fit better, and in the UK a recognised legitimate interest needs no balancing test. Then the factors that call for extra care, such as children, profiling, direct marketing and an imbalance of power.
- Scope and criteria. The processing you are assessing, and likelihood and severity scales that describe the effect on the people concerned, not on the organization.
- What the processing involves. The personal data, the people concerned, the processing steps, the systems, the suppliers and recipients, and where the data goes.
- The purpose test. The purpose, the interest and whose it is, the benefit, and why the interest is lawful, clear and real.
- The necessity and balancing tests. Ten questions: whether the processing helps, is proportionate, has no less intrusive alternative and uses only the data it needs; then whether people would expect it, are told about it, can object easily, and whether children, safeguards and any imbalance of power have been considered.
- Impact on people. Scenarios from unexpected use and profiling to ignored objections, special category data, distress and unexpected sharing, each rated for the people concerned.
- Safeguards. The safeguards that reduce each impact, each referenced to the GDPR article it helps meet, with an owner, a date and the level expected afterwards.
- Conclusion. Data protection advice, the views of the people concerned, and your conclusion: legitimate interests applies, applies once safeguards are in place, or another lawful basis is needed.
What you get from the legitimate interests assessment template, free
The screening verdict, a heat map of the impact on people, the check that tells you whether High or Critical impact remains once your safeguards are in place, a process score out of 100, and the findings a regulator would raise, such as direct marketing without a guaranteed way to object or a privacy notice that does not name the interest. Sign in and it stays in your account, ready for the next review.
The full LIA report turns the legitimate interests assessment template into a finished record, with the safeguards by owner and due date and their GDPR references, the conclusion, an AI-assisted analysis with a 30/60/90-day roadmap, and the whole LIA as a live Excel workbook.
Where this fits
A legitimate interests assessment template answers one question: can you rely on this lawful basis for this processing? Our guide to the legitimate interests assessment explains the test and its traps, and recognised legitimate interests covers the UK’s new basis. If the processing is likely to be high risk, you need a DPIA as well; our comparison of DPIA vs LIA sets out how the two fit together. Record the result in your records of processing and your privacy notice. For the documents around it, see the GDPR Toolkit.
Frequently asked questions
Is a legitimate interests assessment a legal requirement?
The GDPR does not name an LIA as a document, but the accountability principle in Article 5(2) means you must be able to show that the three-part test is met. Regulators expect a written record, and the ICO says you should keep one. A legitimate interests assessment template is the simplest way to create it.
When should I use the legitimate interests assessment template?
Before you start processing on the basis of legitimate interests, and again when the purpose, the data, the people or the context changes. Use it for each processing activity; one assessment covers one purpose.
Does it cover the UK’s recognised legitimate interests?
Yes. If the purpose is one of the conditions in Annex 1 of the UK GDPR, the screening says so and no balancing test is needed, though the processing must still be necessary. Under the EU GDPR, the full three-part test always applies.
Is this a substitute for legal advice?
No. It is a structured self-assessment built from the information you enter, and Governance Docs does not review or verify it. Whether legitimate interests is the right basis for your processing can be a legal question.
What happens to the information I enter?
It is stored with your assessment so you can come back to it, and it is never shared. Describe the processing and the people concerned in general terms rather than entering any real personal data. You can delete an assessment permanently from your account at any time.