What Is Legitimate Interest Under GDPR, and When Can You Use It?

"We'll just use legitimate interest" is not a lawful basis. It's homework.

I hear this a lot: "we don't need consent for that, it's legitimate interest."

Sometimes that's right. Often it's a business reaching for the basis that sounds like it asks the fewest questions, then skipping the part where you actually have to answer three of them.

Legitimate interest is a proper lawful basis under Article 6(1)(f) of the UK GDPR. It's also the one most likely to get you into trouble, because unlike consent, nobody hands you a signed form proving you got it right. You have to prove it yourself, and keep the proof.

The three-part test

The ICO is direct about this one: you must satisfy all three parts before you start using the information. Not two out of three. All three.

→ The purpose test: do you have a genuine, specific interest? "It would be useful for the business" doesn't count. Neither does "everyone does it."
→ The necessity test: is using this data necessary for that purpose, or just convenient? If there's a less intrusive way to get the same result, legitimate interest doesn't clear that bar.
→ The balancing test: do the individual's interests, rights and freedoms outweigh yours?

That last one is where most businesses trip up. Weigh your benefit against the surprise or harm to the person on the other end, and be honest about which one is bigger.

Where it tends to fit

The ICO points to a handful of situations where legitimate interest is often the right call: network and IT security, preventing fraud, administrative transfers within a group of companies, and direct marketing to your own customers, provided you comply with PECR alongside it.

Notice what these have in common. They're specific, they're things a reasonable person would expect a business to do, and none of them need the individual's active agreement to make sense. That's the test in practice: would the person be surprised to learn you were doing this?

Where it doesn't

Public authorities can't use legitimate interest for tasks they're carrying out in the exercise of their official authority. If you're a public body processing data to do the job Parliament gave you, you need a different basis, usually public task.

It also gets harder to justify with children's data, where the balancing test has to give extra weight to a child's ability to understand what's happening to their information and to protect their own interests.

The Experian case: even the professionals get this wrong

In October 2020, the ICO issued Experian with an enforcement notice over its data broking business, which had built marketing profiles on around 51 million UK adults using data pulled from the electoral register and Companies House.

Experian appealed. In February 2023, the First-Tier Tribunal ruled largely in Experian's favour: legitimate interest can be relied on for direct marketing and profiling, even where the processing might surprise the people involved, provided the privacy notice is clear and prominent. The ICO appealed that decision. In April 2024, the Upper Tribunal dismissed the ICO's appeal and confirmed the ruling.

Four years, two tribunals, and one lesson that survives the whole saga: legitimate interest didn't fail Experian. Transparency nearly did. The processing itself was defensible. What kept the ICO's enforcement notice alive for so long was the question of whether people actually knew it was happening.

Write it down

The UK GDPR doesn't say in black and white that you must document a legitimate interests assessment. The ICO's answer is that you have to be accountable, and an LIA is how you show your working if anyone ever asks.

There's no fixed template and no minimum page count. Some LIAs are a paragraph. Others, especially where the processing could feel invasive, run much longer. What matters is that you can point to a written record of the three tests, the date you did them, and the conclusion you reached, before you started processing, not after someone complained.

One extra trigger to know about: if your LIA turns up potential high risks to people's rights and freedoms, that's usually a sign you need a full Data Protection Impact Assessment as well.

The new shortcut: recognised legitimate interests

Since 5 February 2026, a seventh basis has existed alongside the usual six: recognised legitimate interests, introduced by the Data (Use and Access) Act 2025. It covers a fixed list of purposes, including sharing data with a public body that confirms it needs it for an official task, safeguarding children or vulnerable adults, preventing or detecting crime, national security and defence, and responding to emergencies.

Rely on one of these and you can skip the balancing test entirely. Parliament has already decided the interest outweighs the individual's, so long as your processing is strictly necessary for that purpose. It's a narrow list, and it won't cover your marketing campaign or your customer analytics. But if what you're doing falls squarely inside it, it's worth checking before you reach for the longer, three-part version.

Three things to check right now

→ Can you name your legitimate interest in one specific sentence, or does it collapse into "it would help the business"?
→ Have you written down your balancing test, or does it live in someone's head?
→ Would the people affected be surprised if they found out what you were doing with their data?

I work with UK businesses as their outsourced DPO. If you're relying on legitimate interest and you're not sure your paperwork would survive a complaint, drop me a message. Happy to have a no-obligation chat.

Book a no-obligation chat

Sources
ICO, Legitimate interests
ICO, What is the legitimate interests basis?
ICO, How do we apply legitimate interests in practice?
Mills & Reeve, What is a recognised legitimate interest and how might it help me?
Stephenson Harwood, Experian's win against the ICO in Upper Tribunal