How to run a legitimate interests assessment

Legitimate interests is the most flexible lawful basis and the only one that asks you to weigh your interests against the individual's. Here's the three-part test as something you can actually complete.

Article 6(1)(f) permits processing necessary for the legitimate interests pursued by the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject.

That single sentence contains three tests. The ICO calls them purpose, necessity and balancing, and completing them in writing is what turns the basis from an assertion into something you can show.

The purpose test

What are you trying to achieve, and is the interest legitimate? The bar here is lower than people expect. A commercial interest is legitimate. So is preventing fraud, securing your network, or running the organisation.

What it must be is specific. "Improving the business" fails not because it is illegitimate but because nothing can be tested against it. Write the purpose so that a necessity question can be asked of it.

Note that the interest can be a third party's. If you process data for a purpose that benefits someone else, that is within the wording.

The necessity test

Is the processing necessary for that purpose? The ICO's framing is the useful one: necessary does not mean absolutely essential, but it must be more than useful and more than standard practice. It has to be a targeted and proportionate way of achieving the specific purpose.

The question that actually decides it is whether you could achieve the same result with less. Fewer data subjects, fewer fields, a shorter retention period, or aggregated rather than individual records. If you could, the processing as designed is not necessary, and the assessment should say so and change the design.

Necessity is a claim about the data you hold, not the data your system was designed to hold. If the folder supporting this purpose also contains categories nobody intended to collect, the necessity argument covers the design and not the reality.

The balancing test

This is the part that takes judgement. You weigh your interest against the individual's interests, rights and freedoms. The useful anchor is reasonable expectations: would this person, at the point their data was collected, have expected it to be used this way?

Things that push the balance against you:

• The data is special category, or relates to children.
• The processing is not something the person would anticipate from the relationship.
• It involves large-scale profiling, tracking, or combining data the person gave you for different purposes.
• The person has little practical ability to object or to go elsewhere.

Things that support you: a close and obvious relationship to what the person asked for, a clear benefit to them, minimal data, and safeguards such as short retention or an easy opt-out.

An unfavourable balance does not always kill the processing. Often it changes it. Narrowing the data, adding an opt-out, or shortening retention can move the balance, and recording that you did so is part of the value of the exercise.

What to write down, and why it matters later

Article 21 lets the data subject object to processing based on legitimate interests. When that happens you must stop unless you can demonstrate compelling legitimate grounds which override their interests, rights and freedoms.

That is the moment the assessment earns its keep. Producing a dated document that already worked through the balance is a materially stronger position than constructing the argument in response to a complaint.

How EmberHound fits

The necessity limb is the one that fails on evidence rather than on reasoning. EmberHound scans enrolled company devices and reports personal data by category and location, so the assessment can be written against what you hold rather than what you meant to hold.

The judgement in the balancing test stays with your DPO or legal adviser. No tool performs it.

This article is general information, not legal advice. Confirm the obligations that apply to your organisation before acting on it.