# Legitimate Interests Assessment: [Processing activity]

> A legitimate interests assessment (LIA) records why a controller may
> rely on Article 6(1)(f) of the GDPR (Regulation (EU) 2016/679) or the
> UK GDPR for one processing activity. It works through the three
> cumulative conditions described in EDPB Guidelines 1/2024 on
> processing based on Article 6(1)(f) (version 1.0, adopted 8 October
> 2024, public consultation closed 20 November 2024) and in the UK
> ICO's legitimate interests guidance: a legitimate interest exists,
> the processing is necessary for it, and the interests or fundamental
> rights and freedoms of the people concerned do not override it.
> Replace every `[bracketed]` value and every row marked *Example*.
> This is a documentation format, not legal advice: check the current
> official text and ask a qualified professional.

<!--
Guidance: How to use this template
- Write one LIA per purpose. "Marketing" or "security" is too broad;
  "screening online orders for payment fraud before dispatch" is the
  right size.
- Complete it before the processing starts and keep it with the record
  of processing activities (`compliance/gdpr-ropa`). Article 5(2)
  accountability means you must be able to show the reasoning later.
- If the balancing in section 5 points to a high risk, run a DPIA
  (`compliance/dpia`) as well. An LIA does not replace a DPIA.
- The worked example uses Quillmere Books Ltd, a fictional online
  bookshop that screens orders for payment fraud using an external
  scoring service.
- Related templates: privacy notice (`legal-lite/privacy-policy`),
  processor agreement (`legal-lite/dpa`), data sharing agreement
  (`compliance/data-sharing-agreement`), privacy by design review
  (`compliance/privacy-by-design-review`), data subject request
  procedure (`compliance/data-subject-request-procedure`).
-->

## Contents

1. Processing described
2. Can Article 6(1)(f) be used at all
3. Step 1: the legitimate interest
4. Step 2: necessity
5. Step 3: balancing
6. Outcome and decision
7. Transparency and the right to object
8. Review triggers
9. Jurisdiction notes
10. References

## Document control

<!-- Guidance: Name a single owner for the processing and record the DPO's advice, even where it was not followed. -->

| Field | Value |
|---|---|
| Document ID | [LIA-001] |
| Processing activity | [Name, RoPA reference] |
| Controller | [Legal entity; joint controllers if any] |
| Version | [1.0] |
| Status | [Draft / In review / Approved] |
| Owner | [Business owner of the processing, @name] |
| Approvers/reviewers | [DPO or privacy lead, legal] |
| Last updated | YYYY-MM-DD |
| Next review | YYYY-MM-DD |
| Classification | [Internal] |
| Linked DPIA | [DPIA-nnn or "Not required, see section 5.4"] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Business owner | [@name] | [Approved] | YYYY-MM-DD |
| DPO or privacy lead | [@name] | [Advice given: agree / agree with conditions / disagree] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved with a 180-day retention limit for declined-order data |

## 1. Processing described

<!-- Guidance: Describe the processing concretely enough that a reader who was not in the room can judge it: what data, about whom, from where, by whom, for how long, and with which recipients. -->

| Item | Description |
|---|---|
| Purpose | [One sentence] |
| Data subjects | [Customers, prospects, staff, visitors] |
| Personal data | [Categories] |
| Sources | [Directly from the person, devices, third parties] |
| Recipients and processors | [Names or categories] |
| Retention | [Period and trigger] |
| Transfers outside the EEA or UK | [Yes or no; see `compliance/transfer-impact-assessment`] |
| Automated decisions | [Yes or no; if yes, check Article 22] |

*Example:* Quillmere Books Ltd scores each online order before dispatch.
The score uses order value, delivery and billing address match, email
age, device identifier and IP-derived country, sent to a fraud scoring
processor under a processing agreement. Orders above the threshold go
to a staff member for manual review; no order is refused on the score
alone. Data for declined orders is kept for 180 days.

## 2. Can Article 6(1)(f) be used at all

<!-- Guidance: Screen out cases where the basis is unavailable or a better basis fits. Pitfall: choosing legitimate interests because consent "might be refused". -->

| Question | Answer | Notes |
|---|---|---|
| Are we a public authority acting in the performance of our tasks? (Article 6(1), last subparagraph excludes (f) for that) | [Yes / No] | |
| Does another basis fit better, such as contract (6(1)(b)) or legal obligation (6(1)(c))? | [Yes / No] | |
| Does the processing involve special category data (Article 9) or criminal offence data (Article 10)? If yes, a separate condition is also needed | [Yes / No] | |
| Are children's data involved? The text of Article 6(1)(f) gives them particular weight | [Yes / No] | |
| Does sector law or ePrivacy law require consent for part of the activity (for example cookies or electronic marketing)? | [Yes / No] | |
| UK only: does a recognised legitimate interest condition in Annex 1 of the UK GDPR apply (Article 6(1)(ea))? | [Yes / No] | See section 9 |

## 3. Step 1: the legitimate interest

<!-- Guidance: State the interest precisely. The EDPB guidelines say an interest must be lawful, clearly and precisely articulated, and real and present rather than speculative. The CJEU accepted in Case C-621/22 (judgment of 4 October 2024) that a commercial interest can be legitimate, provided it is lawful. Recitals 47 to 49 give examples such as fraud prevention, direct marketing, intra-group administration and network security. -->

| Question | Answer |
|---|---|
| Whose interest is it: ours, a third party's, or both? | [Answer] |
| What exactly is the interest? | [Answer] |
| Is it lawful (not contrary to any law)? | [Answer] |
| Is it real and present, with evidence? | [Answer] |
| What benefit does the processing bring, and to whom? | [Answer] |
| What would happen if we could not process? | [Answer] |

*Example:* Quillmere's interest is to avoid losses from orders paid with
stolen cards (its own interest) and to protect cardholders from misuse
of their cards (a third-party interest). Chargeback records for the last
year show the problem is current. Fraud prevention is named as a
legitimate interest in Recital 47.

## 4. Step 2: necessity

<!-- Guidance: Ask whether the interest can reasonably be met as effectively by less intrusive means. Necessity links to data minimisation (Article 5(1)(c)): test each data field, not the activity as a whole. -->

| Data element | Needed for the interest? | Less intrusive alternative considered | Decision |
|---|---|---|---|
| Order value *(Example)* | Yes, strong fraud signal | None | Keep |
| Address match *(Example)* | Yes | None | Keep |
| Device identifier *(Example)* | Yes, detects repeat attempts | Hashed identifier | Keep, hashed |
| Precise geolocation *(Example)* | No, IP country is enough | IP-derived country only | Drop |
| Social media profile lookup *(Example)* | No | Not used | Drop |
| [Element] | [Yes / No] | [Alternative] | [Keep / Drop / Change] |

Can the purpose be met with less data, less often, by fewer people, or
for a shorter time? [Answer]

## 5. Step 3: balancing

<!-- Guidance: Weigh the interest against the impact on people. Consider the nature of the data, the reasonable expectations of the people concerned, their relationship with you, the likely positive and negative impacts, and the safeguards you add. Article 6(1)(f) requires particular care where the data subject is a child. -->

### 5.1 Nature of the data and of the people

| Factor | Assessment |
|---|---|
| Sensitivity of the data | [Low / Medium / High, with reason] |
| Vulnerable people involved | [Yes / No] |
| Scale (people, records, frequency) | [Figures] |
| Relationship (customer, employee, none) | [Answer] |

### 5.2 Reasonable expectations

<!-- Guidance: Ask whether a reasonable person in this context would expect the processing at the time the data is collected. Expectations depend on the relationship, the privacy information given at collection, the source of the data, and whether the use is new or unusual. -->

| Question | Answer |
|---|---|
| Was the processing explained at collection? | [Answer] |
| Is it common practice in this sector? | [Answer] |
| Did the data come from the person or from another source? | [Answer] |
| Is any element new or surprising? | [Answer] |

### 5.3 Impacts and safeguards

| Possible impact on people | Likelihood | Severity | Safeguard | Residual |
|---|---|---|---|---|
| Genuine customer wrongly flagged and delayed *(Example)* | Possible | Low | Manual review within one working day, no automatic refusal | Low |
| Data reused for marketing *(Example)* | Unlikely | Medium | Purpose limit in processor agreement, separate system | Low |
| Over-retention of declined-order data *(Example)* | Possible | Low | 180-day deletion job, monthly check | Low |
| [Impact] | [Likelihood] | [Severity] | [Safeguard] | [Residual] |

### 5.4 Is a DPIA needed?

[Yes / No], because [reason with reference to the DPIA screening in
`compliance/dpia`].

## 6. Outcome and decision

<!-- Guidance: Record a clear outcome. If people's interests override yours, record that too and choose another basis or stop. Pitfall: approving with safeguards that nobody owns. -->

| Item | Value |
|---|---|
| All three conditions met? | [Yes / No / Yes with conditions] |
| Conditions and owners | [List] |
| Decision | [Proceed / Proceed with conditions / Do not proceed] |
| Decided by | [@name], YYYY-MM-DD |
| DPO advice recorded | [Yes, summary] |

*Example:* Proceed with conditions: hash device identifiers, drop
precise geolocation, keep manual review for every flagged order, and
delete declined-order data after 180 days. Owner: head of e-commerce.

## 7. Transparency and the right to object

<!-- Guidance: Articles 13(1)(d) and 14(2)(b) require you to tell people the legitimate interests you pursue. Article 21 gives a right to object: for direct marketing the objection is absolute; otherwise you must stop unless you show compelling legitimate grounds that override the person's interests, or the processing is for legal claims. -->

| Item | Where handled |
|---|---|
| Interest named in the privacy notice | [Section and link] |
| How people can obtain this LIA or a summary | [Process] |
| How objections are received and decided | [Procedure ID] |
| Objection outcome recorded | [Log] |

## 8. Review triggers

<!-- Guidance: An LIA is only valid for the processing it describes. -->

Review this assessment on [YYYY-MM-DD] or earlier when the purpose,
data, recipients, technology or retention changes; when objections or
complaints show unexpected impact; or when guidance or case law changes.

## 9. Jurisdiction notes

<!-- Guidance: These are dated examples, not a complete survey. Check the current official text in every jurisdiction where you operate. -->

As of October 2026 (not legal advice; check the current official text):

| Jurisdiction | Point | Official source |
|---|---|---|
| EU | Article 6(1)(f) GDPR; EDPB Guidelines 1/2024 were published as version 1.0 for consultation, check whether a final version has been adopted. The Digital Omnibus proposals of November 2025 included GDPR changes that were still under negotiation | https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2024/guidelines-12024-processing-personal-data-based_en |
| UK | The Data (Use and Access) Act 2025 added a recognised legitimate interest basis (UK GDPR Article 6(1)(ea), conditions in Annex 1: public task disclosure requests, national and public security and defence, emergencies, crime, safeguarding). It needs no balancing test but still needs necessity. The provisions commenced on 5 February 2026 according to the ICO and commencement regulations. Ordinary legitimate interests under 6(1)(f) remain | https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/ |
| US | There is no federal equivalent of a lawful-basis regime. State consumer privacy laws mostly use notice and opt-out rights rather than a legitimate interests test; record which state laws apply in your legal register (`compliance/legal-register`) | [State attorney general or regulator page] |

## 10. References

| Reference | Version or date | Use |
|---|---|---|
| Regulation (EU) 2016/679 (GDPR) | OJ L 119, 4.5.2016; check the consolidated text | Articles 5, 6(1)(f), 13, 14, 21, Recitals 47 to 49 |
| EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR | Version 1.0, adopted 8 October 2024 | Three conditions and balancing factors |
| CJEU Case C-621/22, Koninklijke Nederlandse Lawn Tennisbond | Judgment of 4 October 2024 | Commercial interest can be legitimate; strict necessity |
| CJEU Case C-252/21, Meta Platforms and Others | Judgment of 4 July 2023 | Necessity and reasonable expectations |
| ICO guidance on legitimate interests and on recognised legitimate interest | Updated 2026 | UK practice and LIA process |

## Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR), Article 6(1)(f), the EDPB
Guidelines 1/2024 (version 1.0), CJEU case law cited above and the UK
ICO guidance on legitimate interests and recognised legitimate
interest. Article numbers are cited and obligations are summarised in
original wording; no legal or guideline text is reproduced. The worked
example uses a fictional organisation. Check the consolidated text on
EUR-Lex, the current EDPB guidelines and your supervisory authority's
guidance before use. This is a documentation format, not legal advice.
Template licence: MIT.