Legitimate interest

How legitimate interest works

Every use of personal data needs a lawful basis, and Article 6 makes processing lawful only when at least one listed basis applies 1. Consent, contract and legal obligation each fit specific situations. Point (f) covers processing that is necessary for the legitimate interests of the controller or a third party, except where the interests or fundamental rights and freedoms of the person override them 1.

The EDPB reads that one sentence as three cumulative conditions 3.

• Purpose test. The interest must be lawful, precisely articulated and present, so a vague or future interest does not qualify 3.
• Necessity test. The processing must be needed for that interest. If the interest can reasonably be achieved just as effectively by less intrusive means, the basis fails 3.
• Balancing test. The person's interests, rights and freedoms must not take precedence. The weighing covers the impact on the person, their reasonable expectations and any safeguards that limit the impact 3.

Recital 47 says the person's interests could override the controller's interest where data is processed in circumstances where people do not reasonably expect further processing 2. It points to a relevant and appropriate relationship, such as a client, as a setting where a legitimate interest could exist 2.

Direct marketing gets its own sentence in the recital. Processing for direct marketing purposes may be regarded as carried out for a legitimate interest 2. The EDPB reads that as a possibility. Direct marketing does not always constitute a legitimate interest, and all three conditions still apply 3.

The basis also brings duties. The controller has to tell people which legitimate interest it pursues 3. The EDPB guidance also covers how the basis relates to data subject rights, including the right to object to processing for direct marketing 3. That is why a team that relies on it for data enrichment needs a working opt-out path as well as a written assessment.

This page explains how the basis is structured for data teams. It is not legal advice, and national rules can add their own requirements.

What a legitimate interests assessment should cover

A legitimate interests assessment, often shortened to LIA, is the written record of the three tests. The EDPB says controllers should carefully assess and document the conditions before carrying out the processing 3. For a B2B data team, it should cover five points.

**Name the interest precisely.** Write the commercial purpose in one sentence, such as offering accounts payable software to finance leaders at companies in a defined segment. Vague purposes such as general growth fail the first test 3.

**Limit the fields to the purpose.** Necessity is tested against the purpose, and the EDPB links it to the data minimization principle in Article 5 3. A work email and job title may be needed for outreach. A personal mobile number or home address usually is not.

**Check the relationship and expectations.** A contact who met the company at a trade event, or who works at a customer, expects different things from someone whose details came from an unrelated source. Recital 47 makes expectations at the time and in the context of collection part of the assessment 2.

**Record the safeguards.** Safeguards that limit the impact on people count in the balancing 3. Common ones are a clear notice in the first message, an easy opt-out and a short retention period.

**Check other laws first.** The EDPB notes that European and national rules can require consent for some direct marketing, and that the ePrivacy Directive requires prior consent for unsolicited marketing email, subject to exceptions 3. A strong assessment under the GDPR does not override that requirement 3.

Review the assessment when the purpose, the data fields or the audience changes. A new enrichment source or an AI SDR that writes to contacts is new processing that the original balancing did not cover. The same goes for website visitor identification, since the EDPB notes that tracking techniques such as cookies need consent under the ePrivacy Directive 3.

Example of a legitimate interests assessment for an outbound campaign

A RevOps team plans to enrich a list of finance leaders at target accounts with work emails and send a short outbound sequence. Before any lookup runs, the team writes a one-page assessment.

Test        Question                      Answer
Purpose     What is the interest?         offer AP software to finance leads
Purpose     Is it lawful and present?     yes, campaign starts this quarter
Necessity   Which fields are needed?      name, title, company, work email
Necessity   Which fields are excluded?    personal email, mobile, home address
Balancing   Would they expect contact?    role-relevant offer at a work address
Balancing   What limits the impact?       notice and opt-out in first email
Decision    Basis                         legitimate interest, reviewed by privacy lead

The purpose line is specific enough to test, which the EDPB requires of any interest relied on 3. The necessity rows drop fields the campaign does not need. A work email serves the outreach. A personal email does not, so it is excluded before any lookup runs.

The balancing rows rest on expectations. Recital 47 asks whether people can reasonably expect the processing at the time and in the context of collection 2. A finance leader who receives a role-relevant offer at a work address is in a different position from a person contacted at home about something unrelated to their job.

The team then checks how each field will be sourced. RichAPI waterfall responses name the source that answered in a provider field, and lookup inputs stay in request logs for 30 days before they are purged 4. Those details go into the record of where the data came from.

Two contacts reply asking to be removed. They go onto a suppression list that the sequencer and the next enrichment run both read. The B2B contact data that results is smaller than the raw list, and every field on it has a stated reason.

Legitimate interest vs consent

Both are lawful bases listed in Article 6 1. Consent rests on the person's agreement. Legitimate interest rests on the controller's documented assessment that the processing is necessary and fair 3.