Legitimate interests under the GDPR: how to run the three-part test

By the Privacyboard teamPublished 5 November 20268 min read

Short answer

Legitimate interests (GDPR Article 6(1)(f)) lets you process personal data without consent if three conditions are all met: your interest is lawful, clear and real; the processing is strictly necessary for it; and people's rights do not override it. You must run and document this test before you start, tell people which interest you rely on, and respect their right to object.

Legitimate interests is one of the six legal bases in Article 6(1) of the GDPR. It lets a business use personal data without asking for consent, but only if three conditions are all met: the interest is legitimate, the processing is necessary for it, and the rights of the people concerned do not take precedence. You must check and write down those three steps before the processing starts.

This guide walks through the test the way the European Data Protection Board (EDPB) describes it in its Guidelines 1/2024, with a worked example for a small online shop. It is general information, not legal advice.

#What does Article 6(1)(f) actually say?

Processing is lawful if it is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject", in particular where the person is a child.

Two limits are built into the article and its recitals:

Public authorities cannot use it for the performance of their tasks. Their legal basis must come from law.
It is not a default. The EDPB says it should be treated neither as a "last resort" nor as an easy option chosen because it seems less demanding than consent.

The recitals give examples of interests that may be legitimate: preventing fraud and direct marketing (Recital 47), sharing data within a group for internal administration (Recital 48), and network and information security (Recital 49). "May" matters: each still needs the full test.

#What are the three steps of the test?

The Court of Justice of the EU (CJEU) and the EDPB describe three cumulative conditions. If one fails, you cannot use this legal basis.

Step	Question to answer	What fails the step
1. Purpose	Is the interest lawful, clearly and precisely stated, and real and present?	A vague goal ("business purposes"), an unlawful aim, or a future, hypothetical need
2. Necessity	Is the processing strictly necessary, or could you reach the goal just as effectively with less data or a less intrusive method?	Collecting more than needed, or a less intrusive alternative that would work as well
3. Balancing	Do people's interests, rights and freedoms override your interest, taking into account their reasonable expectations and any extra safeguards?	Sensitive data, intrusive tracking, people who would not expect it, children

#Step 1: is the interest legitimate?

The EDPB lists three criteria. The interest must be lawful (not contrary to EU or national law), clearly and precisely articulated, and real and present, not speculative.

In its judgment of 4 October 2024 in the Koninklijke Nederlandse Lawn Tennisbond case (C-621/22), the CJEU confirmed that a purely commercial interest can be legitimate, as long as it is lawful. That is useful for businesses, but it only clears step 1. Steps 2 and 3 still decide the outcome.

#Step 2: is the processing necessary?

"Necessary" does not mean "useful". The EDPB, following the CJEU in Meta v Bundeskartellamt (C-252/21, 2023), asks whether the interest cannot reasonably be achieved just as effectively by other means less restrictive of people's rights. The test is read together with data minimisation in Article 5(1)(c): only the data you need, for only as long as you need it.

A practical way to run this step: write down the data fields you plan to use, then strike out each one you could do without and ask whether the goal still works.

#Step 3: do people's rights override your interest?

This is the balancing test. The EDPB groups the factors in four parts:

The rights and interests at stake for the people concerned, not only privacy but also, for example, freedom of expression or protection from discrimination.
The impact of the processing: the nature of the data (sensitive data or data about vulnerable people weigh heavily), the context (scale, combining datasets, who sees it) and the consequences (loss of control, exclusion, chilling effect from monitoring).
Reasonable expectations: would an average person in this relationship expect the use? An existing customer expects different things from someone who only signed up to a newsletter. The EDPB is clear that mentioning the processing in a privacy notice is not enough on its own to make it expected.
The final balance, including any mitigating measures.

Mitigating measures must go beyond what the GDPR already requires. Encryption, a privacy notice or answering access requests do not count, because you owe them anyway. Examples the EDPB gives include letting people object without the usual limits, or erase data even where Article 17 would not require it. If you add such measures, run the balance again.

If the balance tips towards the individual and no further safeguard fixes it, the processing cannot rely on legitimate interests.

#A worked example: a small online shop

A shop selling kitchen equipment wants to email existing customers a seasonal catalogue of products similar to what they bought.

Purpose. Promoting its products to its customers is a lawful commercial interest, and it is specific and current. Step 1 passes.
Necessity. The shop needs the customer's name, email address and the product category of past orders. It does not need browsing history, location or data bought from third parties. Step 2 passes if it limits itself to those fields.
Balancing. The data is ordinary, the people are adult customers who bought similar items, the message is the same for everyone and there is no tracking across sites. Customers in this relationship can reasonably expect it, and each email has a one-click unsubscribe. The EDPB itself gives "sending the same commercial communication (e.g., a catalogue of products) to all existing customers who have already bought products similar to those that are advertised" as a case where legitimate interests is easier to justify.

Two cautions. First, for email marketing, the ePrivacy rules apply alongside the GDPR. National laws based on Article 13 of the ePrivacy Directive generally require consent for marketing emails, with an exception for existing customers and similar products if they could opt out when their address was collected and in every message. If the ePrivacy rules do not allow the email, the EDPB says there is no legitimate interest to rely on. Second, if the same shop wanted to build detailed profiles from tracking on other websites, the EDPB says the balancing test "would hardly yield positive results".

#What must you tell people, and what can they do?

Information. Under Articles 13(1)(d) and 14(2)(b), your privacy notice must state the legitimate interests you rely on, not only the words "legitimate interest". See our guide to what a privacy policy must include.
Right to object (Article 21(1)). People can object on grounds relating to their particular situation. You must then stop unless you can demonstrate compelling legitimate grounds that override their interests, or the data is needed for legal claims. The burden of proof is on you.
Direct marketing (Article 21(2) and (3)). The right to object to direct marketing is unconditional: no reason needed, no balancing, and you must stop using the data for marketing.
Erasure. A successful objection is one of the grounds for erasure in Article 17(1)(c).

Legitimate interests also does not unlock special categories of data such as health or religion. Those need one of the conditions in Article 9(2) on top of an Article 6 legal basis.

#Checklist: your legitimate interests assessment

Write this down for each activity, before you start, and keep it with your record of processing activities:

The activity and the specific interest, in one or two sentences
Why the interest is lawful, real and present
Whose interest it is (yours or a named third party's)
The exact data fields used, and why each is needed
Less intrusive alternatives you considered and why they would not work as well
Who the people are (customers, prospects, staff, children?) and what they would reasonably expect
The likely impact on them, including any sensitive data
Mitigating measures beyond the GDPR minimum, if any
The outcome and the date, with a review date
How people are told, and how an objection is handled

In Privacyboard, the processing register asks for a legal basis for each activity and, when you choose legitimate interests, asks you to say which interest, so the same wording can feed your privacy policy.

#Is anything changing?

As of 5 November 2026, Article 6(1)(f) is unchanged. The EDPB guidelines cited here are Version 1.0, adopted on 8 October 2024 for public consultation; they are the board's current published guidance on the topic. Separately, the European Commission's "Digital Omnibus" proposal includes GDPR amendments, among them wording on legitimate interests for developing AI. The Council agreed its negotiating position on 21 October 2026. It is a proposal, not law, and negotiations with the European Parliament are still to come.

#FAQ

Not necessarily. It avoids the consent request, but you carry the burden of proof: a documented three-step test, a clear notice and a working objection process. The EDPB warns against choosing it because it looks less demanding.

#Do I need a written legitimate interests assessment?

The GDPR does not name a document, but the accountability principle (Article 5(2)) requires you to be able to demonstrate compliance, and the EDPB says to assess and document the three conditions before processing. In practice, write it down.

#Can I use legitimate interests for cookies and tracking?

Usually not. Article 5(3) of the ePrivacy Directive requires consent to store or read non-essential information on a device, and the EDPB says consent will then likely be the right legal basis for the processing that follows too, which normally rules out legitimate interests in that context.

#Can I rely on someone else's interest?

Yes, Article 6(1)(f) covers the interests of "a third party" too. The EDPB notes that necessity is generally harder to show for a third party's interest than for your own, and that people expect it less.

#Can a public body rely on legitimate interests?

Not for the performance of its public tasks. Article 6(1) excludes it there; the legal basis must come from law.

#How often should I review the assessment?

When the purpose, the data or the tools change, and at a regular interval you set yourself. The GDPR fixes no frequency.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to hello@privacyboard.io.