What is GDPR legitimate interest?
The GDPR lawful basis that lets a business process personal data without consent, backed by a written balancing test.
Legitimate interest — Legitimate interest is one of the lawful bases under the EU's GDPR for processing personal data without consent. It applies when the sender's interest is real, the processing is needed, and the person's rights do not outweigh it. Most B2B cold outreach in the EU relies on it, with a written balancing test.
Also known as: GDPR legitimate interest
Why it matters
The GDPR does not let a business process personal data just because it wants to. It requires one of a fixed set of lawful bases. Consent is only one of them. Legitimate interest is another. It applies when the business has a real interest in the processing, the processing is needed to serve that interest, and a written balancing test shows the person's rights and expectations do not outweigh it. Most European B2B cold outreach relies on this basis. Asking every prospect for consent before the first contact would make outreach impossible.
What makes legitimate interest usable, rather than a loophole, is the balancing test itself. It has to be a real, written assessment. What is the interest? Why is the processing needed? Why does it not override the person's expectations? The business has to be able to produce it if a regulator or the person asks. A business that writes "legitimate interest" into its privacy policy without ever doing that assessment has not established the basis. It has only claimed it.
What a legitimate interest basis requires
- 1
Identify a real interest
State the specific business interest the processing serves, such as B2B sales outreach.
- 2
Show necessity
Confirm the processing is actually needed to pursue that interest, not only convenient.
- 3
Run the balancing test
Weigh the business interest against the individual's rights, expectations and potential harm.
- 4
Document the assessment
Write the test down so it can be produced if challenged.
- 5
Keep an opt-out available
Give the person a way to object, since legitimate interest processing can still be objected to.
The mistake to watch for
Questions
- How is legitimate interest different from consent?
- Consent means the person actively agreed before processing starts. Legitimate interest does not require that agreement. It requires the business to complete and document a balancing test showing its interest does not override the person's rights.
- Does legitimate interest mean no opt-out is needed?
- No. A person can still object to processing based on legitimate interest. That objection has to be honoured, similar in effect to an opt-out.
- Is legitimate interest available for any kind of outreach?
- It depends on the specifics of the processing and the balancing test. That is why it is typically applied to B2B contexts with a written assessment, rather than assumed to cover any use. This is not legal advice.