Legitimate Interests Assessment (LIA) Template, GDPR Art. 6(1)(f)

Purpose, necessity and balancing test for GDPR Art. 6(1)(f), field-level necessity, impacts and safeguards, outcome, right to object, UK notes

ISO & ComplianceStandardGDPR Art. 6(1)(f); EDPB Guidelines 1/2024 (v1.0)legitimate interests assessmentUpdated Oct 29, 2026

Open in editorDownload .md

How to use: Use it when you plan to rely on legitimate interests for one specific purpose. Fill the processing description and the screening questions first, then test necessity field by field before balancing. The main pitfall is one broad LIA for 'marketing' or 'security' that never tests less intrusive alternatives.

Preview

Legitimate Interests Assessment: [Processing activity]

A legitimate interests assessment (LIA) records why a controller may rely on Article 6(1)(f) of the GDPR (Regulation (EU) 2016/679) or the UK GDPR for one processing activity. It works through the three cumulative conditions described in EDPB Guidelines 1/2024 on processing based on Article 6(1)(f) (version 1.0, adopted 8 October 2024, public consultation closed 20 November 2024) and in the UK ICO's legitimate interests guidance: a legitimate interest exists, the processing is necessary for it, and the interests or fundamental rights and freedoms of the people concerned do not override it. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: check the current official text and ask a qualified professional.

Processing described
Can Article 6(1)(f) be used at all
Step 1: the legitimate interest
Step 2: necessity
Step 3: balancing
Outcome and decision
Transparency and the right to object
Review triggers
Jurisdiction notes
References

Document control

Field	Value
Document ID	[LIA-001]
Processing activity	[Name, RoPA reference]
Controller	[Legal entity; joint controllers if any]
Version	[1.0]
Status	[Draft / In review / Approved]
Owner	[Business owner of the processing, @name]
Approvers/reviewers	[DPO or privacy lead, legal]
Last updated	YYYY-MM-DD
Next review	YYYY-MM-DD
Classification	[Internal]
Linked DPIA	[DPIA-nnn or "Not required, see section 5.4"]

Approvals

Role	Name	Decision	Date
Business owner	[@name]	[Approved]	YYYY-MM-DD
DPO or privacy lead	[@name]	[Advice given: agree / agree with conditions / disagree]	YYYY-MM-DD

Revision history

Version	Date	Author	Change summary
0.1	YYYY-MM-DD	[@name]	First draft
1.0	YYYY-MM-DD	[@name]	Example: Approved with a 180-day retention limit for declined-order data

1. Processing described

Item	Description
Purpose	[One sentence]
Data subjects	[Customers, prospects, staff, visitors]
Personal data	[Categories]
Sources	[Directly from the person, devices, third parties]
Recipients and processors	[Names or categories]
Retention	[Period and trigger]
Transfers outside the EEA or UK	[Yes or no; see `compliance/transfer-impact-assessment`]
Automated decisions	[Yes or no; if yes, check Article 22]

Example: Quillmere Books Ltd scores each online order before dispatch. The score uses order value, delivery and billing address match, email age, device identifier and IP-derived country, sent to a fraud scoring processor under a processing agreement. Orders above the threshold go to a staff member for manual review; no order is refused on the score alone. Data for declined orders is kept for 180 days.

2. Can Article 6(1)(f) be used at all

Question	Answer	Notes
Are we a public authority acting in the performance of our tasks? (Article 6(1), last subparagraph excludes (f) for that)	[Yes / No]
Does another basis fit better, such as contract (6(1)(b)) or legal obligation (6(1)(c))?	[Yes / No]
Does the processing involve special category data (Article 9) or criminal offence data (Article 10)? If yes, a separate condition is also needed	[Yes / No]
Are children's data involved? The text of Article 6(1)(f) gives them particular weight	[Yes / No]
Does sector law or ePrivacy law require consent for part of the activity (for example cookies or electronic marketing)?	[Yes / No]
UK only: does a recognised legitimate interest condition in Annex 1 of the UK GDPR apply (Article 6(1)(ea))?	[Yes / No]	See section 9

3. Step 1: the legitimate interest

Question	Answer
Whose interest is it: ours, a third party's, or both?	[Answer]
What exactly is the interest?	[Answer]
Is it lawful (not contrary to any law)?	[Answer]
Is it real and present, with evidence?	[Answer]
What benefit does the processing bring, and to whom?	[Answer]
What would happen if we could not process?	[Answer]

Example: Quillmere's interest is to avoid losses from orders paid with stolen cards (its own interest) and to protect cardholders from misuse of their cards (a third-party interest). Chargeback records for the last year show the problem is current. Fraud prevention is named as a legitimate interest in Recital 47.

4. Step 2: necessity

Data element	Needed for the interest?	Less intrusive alternative considered	Decision
Order value (Example)	Yes, strong fraud signal	None	Keep
Address match (Example)	Yes	None	Keep
Device identifier (Example)	Yes, detects repeat attempts	Hashed identifier	Keep, hashed
Precise geolocation (Example)	No, IP country is enough	IP-derived country only	Drop
Social media profile lookup (Example)	No	Not used	Drop
[Element]	[Yes / No]	[Alternative]	[Keep / Drop / Change]

Can the purpose be met with less data, less often, by fewer people, or for a shorter time? [Answer]

5. Step 3: balancing

5.1 Nature of the data and of the people

Factor	Assessment
Sensitivity of the data	[Low / Medium / High, with reason]
Vulnerable people involved	[Yes / No]
Scale (people, records, frequency)	[Figures]
Relationship (customer, employee, none)	[Answer]

5.2 Reasonable expectations

Question	Answer
Was the processing explained at collection?	[Answer]
Is it common practice in this sector?	[Answer]
Did the data come from the person or from another source?	[Answer]
Is any element new or surprising?	[Answer]

5.3 Impacts and safeguards

Possible impact on people	Likelihood	Severity	Safeguard	Residual
Genuine customer wrongly flagged and delayed (Example)	Possible	Low	Manual review within one working day, no automatic refusal	Low
Data reused for marketing (Example)	Unlikely	Medium	Purpose limit in processor agreement, separate system	Low
Over-retention of declined-order data (Example)	Possible	Low	180-day deletion job, monthly check	Low
[Impact]	[Likelihood]	[Severity]	[Safeguard]	[Residual]

5.4 Is a DPIA needed?

[Yes / No], because [reason with reference to the DPIA screening in compliance/dpia].

6. Outcome and decision

Item	Value
All three conditions met?	[Yes / No / Yes with conditions]
Conditions and owners	[List]
Decision	[Proceed / Proceed with conditions / Do not proceed]
Decided by	[@name], YYYY-MM-DD
DPO advice recorded	[Yes, summary]

Example: Proceed with conditions: hash device identifiers, drop precise geolocation, keep manual review for every flagged order, and delete declined-order data after 180 days. Owner: head of e-commerce.

7. Transparency and the right to object

Item	Where handled
Interest named in the privacy notice	[Section and link]
How people can obtain this LIA or a summary	[Process]
How objections are received and decided	[Procedure ID]
Objection outcome recorded	[Log]

8. Review triggers

Review this assessment on [YYYY-MM-DD] or earlier when the purpose, data, recipients, technology or retention changes; when objections or complaints show unexpected impact; or when guidance or case law changes.

9. Jurisdiction notes

As of October 2026 (not legal advice; check the current official text):

Jurisdiction	Point	Official source
EU	Article 6(1)(f) GDPR; EDPB Guidelines 1/2024 were published as version 1.0 for consultation, check whether a final version has been adopted. The Digital Omnibus proposals of November 2025 included GDPR changes that were still under negotiation	https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2024/guidelines-12024-processing-personal-data-based_en
UK	The Data (Use and Access) Act 2025 added a recognised legitimate interest basis (UK GDPR Article 6(1)(ea), conditions in Annex 1: public task disclosure requests, national and public security and defence, emergencies, crime, safeguarding). It needs no balancing test but still needs necessity. The provisions commenced on 5 February 2026 according to the ICO and commencement regulations. Ordinary legitimate interests under 6(1)(f) remain	https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/
US	There is no federal equivalent of a lawful-basis regime. State consumer privacy laws mostly use notice and opt-out rights rather than a legitimate interests test; record which state laws apply in your legal register (`compliance/legal-register`)	[State attorney general or regulator page]

10. References

Reference	Version or date	Use
Regulation (EU) 2016/679 (GDPR)	OJ L 119, 4.5.2016; check the consolidated text	Articles 5, 6(1)(f), 13, 14, 21, Recitals 47 to 49
EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR	Version 1.0, adopted 8 October 2024	Three conditions and balancing factors
CJEU Case C-621/22, Koninklijke Nederlandse Lawn Tennisbond	Judgment of 4 October 2024	Commercial interest can be legitimate; strict necessity
CJEU Case C-252/21, Meta Platforms and Others	Judgment of 4 July 2023	Necessity and reasonable expectations
ICO guidance on legitimate interests and on recognised legitimate interest	Updated 2026	UK practice and LIA process

Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR), Article 6(1)(f), the EDPB Guidelines 1/2024 (version 1.0), CJEU case law cited above and the UK ICO guidance on legitimate interests and recognised legitimate interest. Article numbers are cited and obligations are summarised in original wording; no legal or guideline text is reproduced. The worked example uses a fictional organisation. Check the consolidated text on EUR-Lex, the current EDPB guidelines and your supervisory authority's guidance before use. This is a documentation format, not legal advice. Template licence: MIT.

Related templates

ISO & Compliance