Legitimate Interest

Legitimate Interest (Article 6(1)(f) GDPR) is often described as the most flexible lawful basis but requires a three-part test: (1) the purpose must be legitimate, (2) processing must be necessary for that purpose, and (3) the individual's interests and fundamental rights must not override the legitimate interest. A Legitimate Interests Assessment (LIA) should be documented before relying on this basis. Common uses include fraud prevention, network security, direct marketing to existing customers, and intra-group transfers. Individuals retain a right to object to processing under legitimate interest, and organisations must comply unless they can demonstrate compelling legitimate grounds.