Legitimate Interest
What is Legitimate Interest?
One of six lawful bases for processing personal data under GDPR. Processing is lawful when necessary for the legitimate interests of the controller or a third party, provided those interests are not overridden by the rights of the data subject.
Terms that appear alongside legitimate interest
Each of these is named in at least one of the same controls as legitimate interest. The number is how many controls name both.
- consent 18 shared controls
- lawful basis 11 shared controls
- data subject 8 shared controls
- gdpr 7 shared controls
- data protection 6 shared controls
- lawful basis for processing 4 shared controls
- profiling 4 shared controls
- code of ethics 4 shared controls
Frameworks that govern legitimate interest
What the standards actually require on legitimate interest
Requirements naming legitimate interest across 6 standards, quoted from the control text.
Standard 1 per Section 19 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be processed fairly + lawfully + transparently.
JM-DPA2020-Standard1-Fair-Lawful-Transparent-Sec19-Lawful-Basis-Consent-Contract-Legal-Vital-Public-Interest-Legitimate · Jamaica DPA 2020 Standard 1 - Fair + Lawful + Transparent Processing + Section 19 + Lawful Basis + Consent + Contract Performance + Legal Obligation + Vital Interests + Public Interest + Legitimate Interests + Privacy Notices →Article 7 of the Jordan PDPL establishes the lawful basis requirement for all processing of personal data. (1) Lawful Basis Categories per Article 7: (a) Consent of data subject (freely given + specific + informed + unambiguous);
JO-PDPL-Standard1-Lawful-Basis-Article7-Consent-Contract-Legal-Vital-Public-Interest-Legitimate · Jordan PDPL Standard 1 - Lawful Basis + Article 7 + Consent + Contract Performance + Legal Obligation + Vital Interests + Public Interest + Legitimate Interests + Privacy Notice + Special Conditions for Sensitive Data →Section 30 of the Kenya DPA establishes the lawful basis framework + Section 29 establishes information notice requirements. (1) Section 30 Lawful Basis - 7 Grounds: (a) Consent of data subject;
KE-DPA-Lawful-Basis-Section30-Consent-Contract-Legal-Vital-Public-Interest-Legitimate-Section29-Notice · Kenya DPA Lawful Basis + Section 30 + Consent + Contract Performance + Legal Obligation + Vital Interests + Public Interest + Legitimate Interests + Section 29 Notice + Express Unequivocal Consent + Withdrawal Right →Reforms the lawful bases under the UK GDPR, including a new list of recognised legitimate interests for which a balancing test is not required, and clarifies the legitimate-interests assessment.
DUAA-P5-LAWFUL · Lawful processing and recognised legitimate interests →Do not subject a data subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a cont...
GDPR-Art.22 · Automated individual decision-making, including profiling →Controllers may refuse suppression in defined cases including legal duty to retain, contractual obligations, or where suppression would prejudice legitimate interests of third parties. Refusal must be reasoned.
AR-25326-ART17-OPPOSITION · Right of Opposition and Refusal Exceptions →Questions people ask about legitimate interest
What is Legitimate Interest?
Why is Legitimate Interest important for compliance?
Which compliance frameworks address Legitimate Interest?
Where can I learn more about Legitimate Interest?
See how Legitimate Interest applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.