Legitimate interestsLegitimate interestsUpdate: DUAA 2025 introduced a \ is the most flexible lawful basis and the most frequently asserted without analysis. The flexibility is conditional: it is available only if you can pass three distinct tests, and a claim that fails any one of them fails entirely.
The three are routinely collapsed into a single vague appeal to reasonableness. Keeping them separate is what makes the analysis useful — and, from the complainant’s side, what makes it attackable.
Test 1 — Purpose: is there a legitimate interest?
Identify the interest precisely, and say whose it is. It can be yours, a third party’s, or a wider public interest. Commercial interests count.
The bar here is low, and arguments are rarely won or lost at this stage. But the purpose has to be stated narrowly enough to test, because the next two tests are applied against it. “Operating our business efficiently” cannot be tested and therefore cannot support anything. “Determining which operator bears liability for a delay claim” can.
Attacking it: if the stated purpose is broad enough to justify anything, say so, and ask for the specific purpose of the specific processing.
Test 2 — Necessity: is this processing necessary for it?
Necessary does not mean convenient, cheaper, standard, or automated. The question is whether the purpose could reasonably be achieved by a less intrusive route. If it could, the basis fails — however sensible the processing is.
This is where most legitimate interests claims actually break, and it is the strongest line of attack for a complainant, because it is factual rather than legal. You do not have to out-argue anyone about proportionality; you have to establish what was actually required.
Two questions do most of the work:
- Did the stated purpose exist at all? If liability never fell to be determined between two organisations, then sharing data “to determine liability between them” was not necessary for anything. The purpose was absent, so nothing could be necessary for it.
- Was all of it necessary? Necessity applies to the data as well as the act. Sharing an identity, a journey, and a claim history when a reference number would have done fails on minimisation even if some disclosure was justified.
For the controller: answer this limb explicitly and factually. A response that restates the purpose and asserts the balance, without addressing necessity, has not answered the complaint — and the complainant will notice.
Test 3 — Balance: do the individual’s rights override it?
Weigh your interest against the individual’s interests, rights and freedoms, taking account of their reasonable expectations. RecitalRecitalThe numbered explanatory paragraphs before an EU instrument's articles. Not binding in themselves, but courts and regulators use them to interpret the articles — Recital 47 on reasonable expectations is the standard example. 47 makes expectations central: would this person, at the time their data was collected, reasonably have expected this?
Factors that push the balance against you:
- The individual is a customer with no visibility of the arrangement.
- The data is sensitive, or the disclosure is to a party they have no relationship with.
- The processing is invisible — they only discover it through a subject access request.
- The interest rests on a mistaken premise. An interest founded on an error carries less weight, because the weight depends on the purpose being real. If data was shared with a third party because you believed they ran the service and they did not, the interest you are balancing was never actually served.
Factors that help you: the individual would plainly expect it; the impact is trivial; you have applied safeguards; you offer a genuine and easy objection route.
What is not a lawful basis
- Industry custom. That an arrangement is normal across a sector does not make it lawful. Each instance of processing needs its own basis. Sector practice can support a legitimate interest — it speaks to reasonable expectations — but it never substitutes for the assessment.
- An existing contract with someone else. A commercial arrangement between two organisations is not a lawful basis for processing a third party’s data.
- Automation. “The system does it automatically” describes a mechanism, not a justification.
- The absence of harm. No harm is relevant to the balance, not to whether a basis exists.
Timing, and the retrospective assessment problem
The assessment must exist before the processing. One written after a complaint is not evidence that the balance was struck; it is evidence that it was not.
If you are in that position, the honest course is to say so: that no contemporaneous assessment exists, that you have now carried one out, and what it concludes. That is recoverable. Presenting a document written last week as though it governed a decision made last year is not, and it is the kind of thing that turns a rights complaint into a credibility finding.
The obligations that come attached
Relying on legitimate interests is not free:
- You must tell people you are relying on it, and what the interest is, at collection.
- They have a right to object, and you must then stop unless you can demonstrate compelling legitimate grounds that override their interests. For direct marketing, the objection is absolute — there is no balancing.
- You must be able to produce the assessment on request.
For the person challenging one
Attack the limbs separately and in order. State the facts that defeat necessity before you argue about the balance, because necessity is objective and the balance is contestable. Ask for the assessment itself and its date. If the answer is that none exists, you have established the point without needing to win an argument about proportionality.