ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The legitimate interests balancing test is the third and hardest part of a legitimate interests assessment. Identifying your purpose is usually easy, and showing the processing is necessary is a matter of asking whether a less intrusive route would do. The balancing test is where you must honestly weigh your interests against those of the people whose data you use, and that is where weak assessments fall apart.
This guide explains how the legitimate interests balancing test works, the factors that matter, how safeguards change the result and how to record the outcome so it stands up to challenge.
Article 6(1)(f) of the GDPR allows processing that is necessary for the legitimate interests of the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child. The wording is why regulators describe a three-part test: purpose, necessity and balancing.
| Part | Question | Typical evidence |
|---|---|---|
| Purpose | Is there a real, lawful interest? | A clear statement of the benefit and who receives it |
| Necessity | Is the processing needed for that purpose? | Why a less intrusive method would not work |
| Balancing | Do individuals’ interests override yours? | Analysis of data, expectations, impact and safeguards |
Our guide to the full legitimate interests assessment shows all three parts in a finished record. This article concentrates on the third.
The Information Commissioner’s Office guidance on applying legitimate interests in practice groups the factors into four areas. The EU regulators use similar reasoning, so the approach carries across borders, though you should read the guidance of your own authority.
Ask how private or sensitive the information is. Special category data and financial information call for stronger justification and stronger protection. Data that people expect to be visible, such as a business contact’s work email, carries less weight than data about health, finances or private life. Consider also the volume and whether data is combined with other sources, because combining can reveal more than either set alone.
Would the person reasonably expect you to use their data this way? Look at your existing relationship, how and when you collected the data, what you told them and whether the use is routine or novel. A customer who buys a product might expect a receipt and delivery updates, but not profiling for an unrelated purpose. Expectations are judged objectively, not by what you wish they were, and your privacy notice alone cannot create an expectation that is otherwise unreasonable.
Consider both the likelihood and severity of harm. Impacts can include loss of control over information, distress, barriers to services, financial loss, discrimination or physical risk. Children’s data deserves particular care because they may understand the consequences less well. A small effect on many people can matter as much as a large effect on a few, so consider scale.
Safeguards reduce impact and can tip a close balance in your favour. Examples include collecting less data, shortening retention, restricting access, pseudonymising, giving a simple opt-out before processing begins and being more transparent than the minimum. The legitimate interests balancing test should be run twice in effect: once without safeguards and once with them, so you can show what difference they make.
Free legitimate interests assessment
Can you rely on legitimate interests for this processing?
Check whether legitimate interests is available, set out the purpose, test necessity, weigh the impact on people from 25 scenarios and choose the safeguards that tip the balance. Built to GDPR Article 6(1)(f), free.
Some teams use a numeric score; others use a narrative. Either is acceptable if the reasoning is visible. If you score, define the scale in advance and record why each factor received its rating, so two assessors would reach a similar result. Do not let the arithmetic replace judgment. A single serious factor, such as processing sensitive data in a way people would not expect, can outweigh several favourable ones.
The outcome should be one of three: the balance favours the processing, the balance favours it only with stated safeguards, or the balance does not favour it and another lawful basis or a different approach is needed. Our comparison of legitimate interests vs consent helps when the result points you elsewhere.
Relying on legitimate interests gives individuals a right to object. If someone objects, you must stop unless you can show compelling legitimate grounds that override their interests, or the processing is for legal claims; for direct marketing the objection is absolute. This affects the assessment because you should plan how objections will be received and handled. Read our guidance on the right to object under legitimate interests for the process, and make sure the assessment records how people are told about the right.
The UK GDPR does not require a legitimate interests assessment to be written down, but the ICO says organisations should record their assessments as part of accountability, and doing so is the only practical way to show the balancing was genuine. A good record contains the purpose, the necessity reasoning, the four factors with evidence, the safeguards adopted, the conclusion, the decision-maker, the date and the review trigger.
Review the record when the purpose, the data, the audience or the technology changes, and at a fixed interval as a check. If the assessment is tied to a wider record of your activities, our guide to a DPIA compared with an LIA explains when a fuller impact assessment is needed as well.
The interest you rely on may be your own or a third party’s, such as a partner organisation or the public. Whoever benefits, the analysis of the people affected is the same. Pay particular attention to children and to groups who may be less able to understand or resist the processing, such as people in a weak bargaining position with you. Employees, tenants and patients often cannot easily object without consequences, which lowers the weight of a supposed opt-out and should make you more cautious about the impact.
Where the processing involves children, ask whether you should rely on this basis at all, and if you do, document the extra safeguards, such as age-appropriate notices and stricter limits on profiling. Check too whether a narrower rule applies in your jurisdiction. Some reforms create a defined list of activities that need no balancing at all; our note on recognised legitimate interests explains the UK approach.
Do not run the assessment alone in the privacy team. Ask the business owner to describe the purpose and benefits, ask security about safeguards and, where the processing is significant, seek the views of a sample of the people affected. Record who was consulted and what changed as a result, since that shows the balance was tested rather than assumed.
The following is a hypothetical example invented for illustration. An online retailer wants to use past purchase data to send existing customers emails about similar products. The purpose is genuine marketing of its own goods. The data is ordinary purchase history, not special category. Customers bought recently, were told about marketing at checkout and can opt out in every message, so the use is within reasonable expectations. The impact is low: an email that can be stopped. Safeguards include an easy unsubscribe and no sharing with outside advertisers.
The balance favours the processing. Suppose instead the retailer wanted to infer health conditions from purchases and target adverts on that basis. The data becomes sensitive, expectations collapse, impact rises and no simple safeguard fixes it, so the balance would not favour the processing and this basis would not be available.
Frequent weaknesses include starting from the conclusion and working backwards, listing only the organisation’s benefits, ignoring people who are not customers, treating the privacy notice as proof of expectations, skipping the impact on children, and never reviewing the record. Another is applying one assessment to several unrelated purposes. Each purpose needs its own balance because the data, expectations and impact differ.
A consistent format helps assessors cover every factor and gives auditors comparable records. The Legitimate Interests Assessment Report and Workbook provides a structured report covering the three-part test, with a workbook for recording the analysis. Whatever format you choose, keep the same headings for every assessment.
Article 6(1)(f) requires that individuals’ interests do not override yours, so some form of balancing is inherent in relying on the basis. Recording it is a matter of accountability and good practice.
Yes. Reduced data, shorter retention, opt-outs and greater transparency can move a borderline case in favour of processing, provided you record what you adopted and follow through.
Each distinct purpose needs its own balance. Similar low-risk uses can share a template, but the analysis should reflect the actual data and audience.
You cannot rely on legitimate interests for that processing. Consider consent, another lawful basis, redesigning the processing or not proceeding.
Review when the purpose, data, audience or technology changes, and at a regular interval such as annually so that the record stays accurate.
September 30, 2026
