Legitimate Interests and Debt Recovery: 2026 Guide

Debt recovery is a clear case where an organization has a real interest in processing personal data, and legitimate interests is the basis most often relied on. A business that is owed money is entitled to contact the debtor, keep records of the account and, in appropriate cases, instruct a collection agency or start legal action. Yet debt recovery also affects people at a stressful moment, so the balancing test carries real weight.

This guide explains how to apply the three-part test to collections, what data you can use, how to handle tracing, agencies and sales of debt, and how to treat objections and vulnerable customers fairly. It is general information, not legal advice, and sector rules such as consumer credit regulation may add further duties.

Why legitimate interests fits debt recovery

Consent does not work for debt recovery, because a debtor is unlikely to agree to be chased. Where the debt arises under a contract, the contract basis may cover routine account administration, but recovery steps beyond the contract, such as instructing an agency or tracing, usually rely on legitimate interests.

The interest is real and generally accepted: recovering money that is lawfully owed. The question is how you pursue it. The GDPR requires that your methods are necessary and proportionate, and that they do not override the person’s rights. Our overview of legitimate interests examples shows how the test works across settings.

Step one: define the interest

State the interest specifically: recovering a defined debt arising from a defined contract, where payment reminders have not resulted in payment. Avoid using the label as cover for general profiling of customers or for pursuing amounts that are disputed and unproven.

Check that the debt is genuine and accurate before any recovery step. Chasing the wrong person, or the wrong amount, is both a data protection issue, because of accuracy, and a fairness problem.

Recovery activity	Basis often relied on	Main risk
Reminders and statements to the debtor	Contract or legitimate interests	Tone and frequency
Instructing a collection agency	Legitimate interests	Sharing more data than needed
Tracing a debtor who has moved	Legitimate interests, carefully assessed	Intrusive methods and third-party data
Selling the debt to another company	Legitimate interests with transparency	Accuracy and notice to the debtor
Reporting to credit reference agencies	Depends on national law and rules	Accuracy and fair notice

Step two: necessity and data minimisation in debt recovery

Ask what data each step requires. A reminder needs the name, contact details and account details. An agency needs those plus the amount and history, but not the entire customer file. Tracing may need current address information, but not health, family or unrelated financial data.

Avoid gathering extra information about the debtor from social media, neighbours or employers, which is intrusive and hard to justify. Use the least intrusive method that works, escalate only when earlier steps fail and keep a record of each step and its reason.

Step three: balancing fairness and impact

Debt recovery can cause distress, especially when people face hardship. Weigh your interest against the effect on the individual: the size of the debt, the person’s circumstances, how long the debt has run and whether they have engaged. Regulators expect proportionate contact, and sector rules often limit frequency and timing.

Identify vulnerable customers early. If a person tells you they are in financial difficulty or have a health condition, adapt your approach and consider forbearance. Where you hold sensitive data about vulnerability, protect it and use it only to treat the person fairly. Record the safeguards that make your approach proportionate.

• Contact people at reasonable times and frequencies
• Never disclose the debt to family, neighbours or colleagues
• Recognise and support vulnerable customers
• Keep accurate, dated records of every contact

Using collection agencies and selling debt

If an agency acts on your instructions, it is normally your processor, and you need a contract that sets out permitted use, security, retention and reporting. If an agency buys the debt, it becomes a controller in its own right and needs its own basis and notices.

Either way, tell the debtor who now holds the debt, and make sure the data transferred is accurate and limited to what is required. Check agencies’ methods and complaint handling regularly, because you remain responsible for choosing reliable partners. Our controller and processor records guide explains how to document the roles.

Transparency for debt recovery and the right to object

Your privacy notice should explain that data may be used for debt recovery and shared with agencies, advisers and courts where necessary. Give this information before any debt arises, for example at contract stage, and repeat the key facts in collection letters.

Individuals can object under Article 21. In debt recovery you may be able to continue if you demonstrate compelling legitimate grounds, or if the processing is needed for the establishment, exercise or defence of legal claims, but you must consider each objection properly. Our page on legitimate interests and the right to object explains the process.

Accuracy, retention and disputes in debt recovery

Keep debt data accurate and up to date. If a debtor disputes the amount, record the dispute, investigate and pause recovery where appropriate. When the debt is paid or written off, stop processing for recovery, and delete or restrict the data in line with your retention schedule.

Retention should reflect limitation periods and record-keeping duties, but should not be indefinite. Write the periods down and align them with your record of processing, as explained in ROPA retention periods.

Automation, scoring and communication channels

Many teams now use automated scoring to decide who is contacted, by which channel and how often. Test these models for fairness: do they treat certain groups worse, or push people towards more aggressive contact simply because of postcode or age? Keep humans in the loop for decisions with real consequences, and record how the model was validated. If the scoring is extensive, compare it with the thinking in the legitimate interests balancing test.

Channel choice matters too. Text messages, calls and emails are subject to electronic marketing and communication rules, and repeated contact at the wrong time can become harassment. Set clear rules on frequency, hours and content, and audit a sample of contacts each month.

Finally, train collection staff. They should know what they may say, what they may never disclose and how to recognise distress. A short script and an escalation route to a supervisor prevent most complaints.

Common mistakes

Typical failures include using inaccurate data, chasing disputed debts as if proven, sharing too much with agencies, using intrusive tracing, contacting third parties, ignoring vulnerability, lacking a written assessment and using the recovery data for marketing. Another is failing to apply the same standard to outsourced partners.

Review the assessment when you change agencies, add new tracing tools or change contact rules. If you use automated scoring to decide who to chase, check for unfair outcomes and consider whether a DPIA is needed; see when a DPIA is required.

Keeping evidence for complaints

Complaints about collections are common, so keep a clear audit trail: dates of contact, channels used, what was said, any vulnerability flags and the reason for each escalation. When a complaint or regulator query arrives, you can show what happened and why. Review complaint themes each quarter and fix the process rather than only the case.

A short worked example

A telecom provider has unpaid final bills. It sends two written reminders, then instructs an agency, providing only name, contact details, amount and dates. Its assessment records the interest, the alternatives it considered, the limits on contact and the treatment of vulnerable customers. Tracing is restricted to lawful address checks.

Objections are logged, and debts in dispute are paused. Debts are sold only to buyers that accept the same standards, and debtors are told of the sale. The assessment is reviewed each year and after any change of agency. It is documented, fair and proportionate.

Recording the assessment

If you want a structured way to record the purpose, necessity, balance and safeguards, the Legitimate Interests Assessment Report and Workbook provides a report and workbook that follow the three-part test, in line with the ICO guidance on legitimate interests. Whatever tool you use, sound legitimate interests and debt recovery practice depends on accurate data, proportionate steps and fair treatment of the people concerned.

Legitimate interests and debt recovery FAQ

Can we rely on legitimate interests for debt recovery?

Often yes, for steps such as instructing agencies or tracing, provided you pass the necessity and balancing tests. Routine account administration may fall under contract.

Can we tell a debtor’s family or employer about the debt?

Generally no. Disclosing a debt to third parties is intrusive and hard to justify. Contact the debtor directly.

Is an agency a processor or controller?

If it acts on your instructions, it is usually a processor. If it buys the debt, it becomes a controller and needs its own basis and notices.

How should we treat vulnerable customers?

Identify vulnerability early, adapt contact and payment options and use sensitive information only to treat the person fairly, with appropriate protection.

Can debtors object to recovery?

They can object under Article 21. You must consider the objection and may continue if you show compelling grounds or if processing is needed for legal claims.