Legitimate Interest
What is Legitimate Interest?
One of six lawful bases for processing personal data under GDPR. Processing is lawful when necessary for the legitimate interests of the controller or a third party, provided those interests are not overridden by the rights of the data subject.
Terms that appear alongside legitimate interest
Each of these is named in at least one of the same controls as legitimate interest. The number is how many controls name both.
- consent 18 shared controls
- lawful basis 11 shared controls
- data subject 8 shared controls
- gdpr 7 shared controls
- data protection 6 shared controls
- lawful basis for processing 4 shared controls
- profiling 4 shared controls
- code of ethics 4 shared controls
Frameworks that govern legitimate interest
What the standards actually require on legitimate interest
Requirements naming legitimate interest across 6 standards, quoted from the control text.
An employer relying on legitimate interest must show that the purpose is legitimate, that the chosen method or technology is necessary for it and proportionate to the business need, and that it runs in the least intrusive way, aimed at the specific area of ris...
article-29-working-party-opinion-2-2017-on-data-processing-at-work-wp249::3.1.1(c) · 3.1.1(c) Legitimate interest: a legitimate purpose, a necessary and least intrusive method, a demonstrated balance →Handing footage to law enforcement is a separate operation needing its own justification. Where national law requires the controller to cooperate (a police request in an investigation), the basis is the legal obligation read with that law and the purpose-chang...
edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::4.2 · 4.2 Disclosure to law enforcement: legal obligation where the law requires it, otherwise legitimate interest on reasonable suspicion →Scientific research, non-profit or commercial, can be a legitimate interest and is generally attributed special importance, so a controller can often give it significant weight in the balancing test;
edpb-guidelines-1-2026-on-processing-of-personal-data-for-scientific-research-purposes::4.3 · 4.3 Legitimate interest: significant weight for research, reasonable expectations, and safeguards folded into the balancing test →Legitimate interests is the most flexible basis, but the employer must weigh its interests, and how necessary the monitoring is, against what workers stand to lose in rights and freedoms in the particular case, and should run the purpose, necessity and balanci...
uk-ico-employment-practices-and-data-protection-monitoring-workers-2023::1.4(d) · 1.4(d) Legitimate interests: pass the purpose, necessity and balancing tests, record a legitimate interests assessment, and respect reasonable expectations →Where processing rests on legitimate interest, only data strictly necessary for the purpose may be processed, the controller must ensure the processing is transparent to data subjects, and the Authority may require a risk report verifying that there are no con...
ley-org-nica-de-protecci-n-de-datos-personales-lopdp::9 · Art. 9: conditions for processing on legitimate interest →Standard 1 per Section 19 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be processed fairly + lawfully + transparently.
JM-DPA2020-Standard1-Fair-Lawful-Transparent-Sec19-Lawful-Basis-Consent-Contract-Legal-Vital-Public-Interest-Legitimate · Jamaica DPA 2020 Standard 1 - Fair + Lawful + Transparent Processing + Section 19 + Lawful Basis + Consent + Contract Performance + Legal Obligation + Vital Interests + Public Interest + Legitimate Interests + Privacy Notices →Questions people ask about legitimate interest
What is Legitimate Interest?
Why is Legitimate Interest important for compliance?
Which compliance frameworks address Legitimate Interest?
Where can I learn more about Legitimate Interest?
See how Legitimate Interest applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.