Legitimate interest is a legal basis under which processing is lawful if it is necessary for the purposes of legitimate interests and the interests of the data subject do not override them.
The three-step test
Art. 6(1)(f) GDPR requires a three-step test:
- There must be a legitimate interest of the controller or a third party. Legal, economic and non-material interests may qualify.
- The processing must be necessary for the purposes of that interest. If a less intrusive means is available, the processing is not permitted.
- The interests, fundamental rights and freedoms of the data subject must not override it (balancing of interests).
What matters in the balancing test
Factors to consider include in particular the reasonable expectations of the data subject, the type of data, the scale of the processing and possible safeguards. The GDPR cites fraud prevention, network and information security and direct marketing as examples of possible legitimate interests.
The balancing test should be documented. Data subjects can object to the processing under Art. 21 GDPR. Public authorities cannot rely on this legal basis in the performance of their tasks.
Legal provisions
- Art. 6(1)(f) GDPR
- Legitimate interest as a legal basis.
- Recitals 47 to 49 GDPR
- Examples of legitimate interests and guidance on the balancing test.
- Art. 13(1)(d) GDPR
- Obligation to state the legitimate interest pursued.
- Art. 21 GDPR
- Right to object to processing on this basis.
Related terms.
Legal basis for processing The legal basis is the statutory permission on which any processing of personal data must be based in order to be lawful. Art. 6(1) GDPR 
Right to object The right to object allows data subjects to object to processing of their data that is based on legitimate interests or on a task carried out in the public interest. Art. 21(1) GDPR Consent Consent is a freely given, specific, informed and unambiguous indication of a person's wishes by which they agree to the processing of their data. Art. 4(11) GDPR
All terms from A to Z Right to object The right to object allows data subjects to object to processing of their data that is based on legitimate interests or on a task carried out in the public interest. Art. 21(1) GDPR Consent Consent is a freely given, specific, informed and unambiguous indication of a person's wishes by which they agree to the processing of their data. Art. 4(11) GDPR 