A Legitimate Interests Assessment (LIA) is a documented analysis used when an organisation relies on legitimate interests as its lawful basis for processing personal data under Article 6(1)(f) of the UK GDPR. Harper James is a UK full-service commercial law firm advising businesses on the laws of England and Wales. The assessment records why the processing is needed, why legitimate interests apply, and why those interests do not override the rights and freedoms of individuals.
An LIA normally follows a three-part test. First, the organisation identifies a specific legitimate interest, such as fraud prevention, network security, business administration or relevant direct marketing. Second, it considers whether the processing is necessary for that purpose, including whether a less intrusive method would achieve the same result. Third, it balances the organisation’s interests against the likely impact on individuals, taking account of the type of data, their reasonable expectations, the relationship with the organisation and the safeguards in place.
A practical LIA should describe the processing activity, the categories of individuals and data involved, the data sources, retention period, recipients and security measures. It should also record the outcome of the balancing test and any controls required, such as data minimisation, restricted access, shorter retention, a clear privacy notice or an easy method for exercising the right to object. The assessment should correspond with the organisation’s records of processing and privacy information.
Legitimate interests is not available in every situation. Public authorities cannot rely on it when performing their tasks, and processing special category data requires an additional condition under Article 9 of the UK GDPR. Direct marketing also requires compliance with the Privacy and Electronic Communications Regulations, while online tracking technologies have separate requirements. An LIA should be reviewed when the purpose, data, technology, recipients or risk profile changes, and organisations should be able to produce it as evidence of their accountability.