Data processing: legitimate interests

Identify a legitimate interest

A legitimate interest is typically:

• reasonable and expected by the individual
• not harmful or intrusive
• aligned with the organisation’s goals

Examples of legitimate interests include:

• preventing fraud
• ensuring IT security
• direct marketing (with safeguards)
• internal administrative tasks
• employee monitoring for safety

Legitimate interests can be those of a controller or a third party.

Show it’s necessary

You must be able to show why it’s necessary to use personal data to achieve your objective.

The ICO has guidance on when processing counts as necessary.

Balance it against the person’s interests

You must balance the legitimate interests against your client’s interests, rights and freedoms.

Your client’s interests are likely to override your legitimate interest if:

• they would not ‘reasonably expect’ you to use their data in the way you’re using it, or
• if it could cause ‘unwarranted harm’

Read the ICO’s guidance on balancing legitimate interests.

Marketing

To rely on legitimate interests for marketing, you need to show that:

• using someone’s data will have a minimal impact on their privacy
• they are not likely to object to you using their data

For electronic marketing, you may need to consider consent as a lawful basis.

Read the ICO’s guidance on electronic and telephone marketing.

Children

You can rely on legitimate interests when using children’s data, but you should take extra care to make sure their interests are protected.

The information in your privacy notice needs to be age appropriate.

Read the ICO’s guidance on children and the UK GDPR.

Data to a third party

You may rely on legitimate interests to disclose personal data to a third party.

These might be your own interests, the interests of a third party, or both.

You should consider:

• why the third party wants the information
• if they need it
• what they’ll do with it

You can rely on legitimate interests for the disclosure if it passes the three-part LIA test.