Legitimate interest: the lawful basis that requires an argument

Legitimate interests is the most flexible lawful basis for processing personal data and the one that asks most of you in return. The others are relatively mechanical — a contract exists or it does not, a law requires something or it does not — while this one requires you to weigh your own interest against somebody else's rights and to be able to show how you did it.

The three parts of a legitimate interest assessment

• Purpose: what interest are you pursuing, stated specifically. «Marketing» is not a purpose; «telling existing customers about a product related to one they bought» is.
• Necessity: is the processing actually needed for that purpose, or would something less intrusive achieve it.
• Balance: would the person reasonably expect this, and does your interest outweigh the impact on them.
• All three, in writing, dated before the processing starts — the assessment is the basis, not a document about it.

Where it fits and where it does not

It fits ordinary business processing a person would expect: fraud prevention, network security, internal administration, chasing an unpaid invoice, letting an existing customer know about something similar. It fits far less comfortably where the person would be surprised, where children are involved, or where the data is sensitive. And it does not rescue processing somebody has objected to — the right to object is strongest precisely against this basis, which is the trade for its flexibility. If your reaction to that is that objections would be inconvenient, the honest reading is that legitimate interests may not be the right basis.

Direct marketing by electronic means usually has separate rules on top of the lawful basis. Satisfying the balancing test does not by itself permit an email campaign — the marketing regime applies as well, and the two are routinely conflated.

Writing the assessment so it survives scrutiny

1. Keep it short — a page per purpose beats a template nobody completes honestly.
2. Name the specific interest rather than the general activity, since the balance turns on specificity.
3. State what you considered and rejected as less intrusive, which is the part that demonstrates necessity.
4. Describe the impact on the person in their terms, not yours.
5. Record the date and who decided, because the determination must predate the processing.
6. Revisit when the processing changes, since the assessment covers what you described rather than what you now do.

Ettex Records holds the assessments beside the record of what personal data you hold and on what basis, which is the pairing a regulator asks for. Where the basis turns out to be consent instead, the obligations differ enough that the choice is worth settling before collection rather than after.