Legitimate Interest Assessment: The Three-Part Test After EDPB Guidelines 1/2024

This guide follows Article 6(1)(f) GDPR and the EDPB's Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (version 1.0, adopted on 8 October 2024 for public consultation and cited by the EDPB since). The EDPB stresses that legitimate interest is neither a last resort nor an easy default: it is a legal basis like the others, with conditions you must meet and document before the processing starts.

The three cumulative conditions

Condition	The question
1. Legitimate interest	Do you or a third party pursue an interest that is lawful, clearly and precisely articulated, and real and present?
2. Necessity	Is processing this personal data necessary to achieve that interest, or could you achieve it reasonably with less data or less intrusive means?
3. Balancing	Do the data subjects' interests or fundamental rights and freedoms override your interest?

All three must be met. Fail one, and you need another legal basis or a different approach.

Step 1: Identify and articulate the interest

Not every interest is legitimate. According to the EDPB, it must be:

lawful: not contrary to EU or member state law;
clearly and precisely articulated, so that it can be properly balanced;
real and present, not speculative, at the time of processing.

In KNLTB (C-621/22, 4 October 2024), the Court of Justice confirmed that a commercial interest can be a legitimate interest, provided it is not contrary to the law; this must be assessed case by case. Write the interest as a concrete sentence, for example "preventing payment fraud on our checkout", not "business purposes".

Step 2: Test necessity

Processing must be necessary for the interest pursued. That means checking whether the interest can reasonably be achieved just as effectively by other means less restrictive of people's rights, and applying data minimisation: only the data actually needed, for no longer than needed. If you could reach the same result with aggregated or pseudonymised data, the identifiable version is not necessary.

Step 3: Balance the interests

The EDPB's guidelines structure the balancing in four parts:

the data subjects' interests, fundamental rights and freedoms;
the impact of the processing on them, considering the nature of the data, the context of the processing and any further consequences;
their reasonable expectations, for example based on their relationship with you;
the final balancing, including whether additional mitigating measures can tip it.

The aim is not to avoid any impact on people, but to avoid a disproportionate one. Mitigating measures that help include shorter retention, pseudonymisation, an easy opt-out beyond the legal minimum, and clear advance information.

Special rules to remember: public authorities cannot rely on legitimate interest for processing in the performance of their tasks (Article 6(1), last subparagraph); people have the right to object to processing based on legitimate interest (Article 21(1)), and an absolute right to object to direct marketing (Article 21(2) and (3)).

What to document

Section	Content
Processing	The activity, data categories, data subjects, systems and retention
Interest	The precise interest, whose it is, and why it is lawful, real and present
Necessity	Why the data is needed and which less intrusive options you considered and rejected
Balancing	Impact on people, their reasonable expectations, safeguards, and your conclusion
Transparency	How the interest is described in your privacy notice (Article 13(1)(d)) and how people can object
Review	Owner, date and when to review (for example on any change in purpose or data)

Common uses, and their weak points

Fraud prevention and IT security are classic legitimate interests (recitals 47 and 49 GDPR); keep the data and retention proportionate.
Direct marketing to existing customers may be a legitimate interest (recital 47), but national e-marketing rules may require consent for electronic messages, and objection must always be honoured.
Analytics and personalised advertising based on cookies need consent for the cookies under the ePrivacy rules first; see cookie banner requirements.

An LIA template that follows this test. The GDPR Records of Processing (RoPA) Kit includes a legitimate interest assessment template, controller and processor RoPA templates, a data inventory workbook and a consent record template.

Legitimate Interest Assessment: The Three-Part Test After EDPB Guidelines 1/2024

The three cumulative conditions

Step 1: Identify and articulate the interest

Step 2: Test necessity

Step 3: Balance the interests

What to document

Common uses, and their weak points

Sources

Related tools

Data Mapping Tool

GDPR Compliance Checklist