What is GDPR legitimate interest?
Put the words in your privacy policy without a written test behind them, and you've claimed a basis you don't have.
Want to see it first? Book a demo
Legitimate interest — Legitimate interest is one of the lawful bases under the EU's GDPR for processing personal data without consent. It applies when the sender's interest is real, the processing is needed, and the person's rights do not outweigh it. Most B2B cold outreach in the EU relies on it, with a written balancing test.
Also known as: GDPR legitimate interest
Why it matters
The GDPR doesn't let a business use personal data just because it wants to. It needs one of a fixed set of lawful bases, and consent is only one of them. Legitimate interest is another. It applies when three things hold. You have a real interest in using the data. You need that use to serve the interest. And a written balancing test shows the person's rights and hopes don't outweigh it. Most B2B cold outreach in Europe rests on this basis, since asking every prospect for consent before the first contact would make outreach impossible.
The balancing test is what makes this basis usable, not a loophole. It has to be a real, written check that answers three questions. What is your interest? Why do you need the data use? Why doesn't it override what the person would expect? You have to be able to show it if a regulator or the person asks. If you write "legitimate interest" into your privacy policy and never do the test, you haven't set up the basis. You've only claimed it.
What a legitimate interest basis requires
- 1
Identify a real interest
Name the business interest the data use serves, such as B2B sales outreach.
- 2
Show necessity
Check that you need the data use for that interest, and that it's more than handy.
- 3
Run the balancing test
Weigh the business interest against the person's rights, hopes and possible harm.
- 4
Document the assessment
Write the test down so it can be produced if challenged.
- 5
Keep an opt-out available
Give the person a way to object, since they can still object to this kind of data use.
The mistake to watch for
Questions
- How is legitimate interest different from consent?
- Consent means the person said yes before any data use starts. Legitimate interest doesn't need that yes. Instead, the business must do a balancing test, write it down, and show its interest doesn't override the person's rights.
- Does legitimate interest mean no opt-out is needed?
- No. A person can still object when legitimate interest is the basis. You have to honour that objection, much like an opt-out.
- Is legitimate interest available for any kind of outreach?
- No, not by default. Whether it fits turns on the details of the data use and the balancing test. That's why firms usually apply it to B2B outreach with a written test, rather than assume it covers any use. This is not legal advice.