Privacy Glossary

Legitimate Interest

A lawful basis under GDPR for processing personal data when a controller has a genuine, proportionate interest that is not overridden by the data subject's rights.

GDPR

Full Definition

Legitimate Interest (Article 6(1)(f) GDPR) is often described as the most flexible lawful basis but requires a three-part test: (1) the purpose must be legitimate, (2) processing must be necessary for that purpose, and (3) the individual's interests and fundamental rights must not override the legitimate interest. A Legitimate Interests Assessment (LIA) should be documented before relying on this basis. Common uses include fraud prevention, network security, direct marketing to existing customers, and intra-group transfers. Individuals retain a right to object to processing under legitimate interest, and organisations must comply unless they can demonstrate compelling legitimate grounds.

How each law treats it

GDPRArticle 6(1)(f)

Processing is lawful where it is necessary for the legitimate interests pursued by the controller or a third party, except where those interests are overridden by the data subject's interests, rights and freedoms.

UAE PDPLArticle 4(1)(g)

Legitimate interests of the controller or a third party permitted where not in conflict with data subject rights. The Executive Regulations are expected to narrow the test.

DPDP ActN/A

The DPDP Act does not include a legitimate interests basis. Non-consent processing is restricted to the Section 7 Certain Legitimate Uses list.

In practice

Run the three-part test every time: purpose test, necessity test, balancing test. Document the outcome.
Common valid grounds: fraud prevention, information security, direct marketing to existing customers (GDPR Recital 47), network security.
Grant data subjects the right to object (Article 21) — the right is particularly strong against direct marketing (absolute right to object).

Common pitfalls

Treating legitimate interests as the default basis. It isn't — it's the fallback where consent, contract or legal obligation don't fit.
Running an LIA that fails the balancing test and ignoring the result. Where the data subject's interests override, the processing is unlawful.
Using legitimate interests for processing involving special category data (Article 9) — you need an Article 9 condition in addition.

Frequently asked questions

Can I use legitimate interests for direct marketing?+

GDPR Recital 47 says processing for direct marketing may be regarded as a legitimate interest. ePrivacy still requires consent for electronic marketing in most EU member states, so legitimate interests covers the data-protection side but not the ePrivacy side.

What about profiling under legitimate interests?+

Possible, but the balancing test is harder to pass. Automated decision-making with significant effects additionally triggers Article 22, which has its own conditions.

Does the data subject's right to object apply?+

Yes. Article 21 gives an absolute right to object to direct marketing and a qualified right to object to other legitimate-interests processing (the controller can continue only on compelling grounds).

Back to all terms