Legitimate interest (LIA)
Definition
A lawful basis allowing processing necessary for the legitimate interests of the controller or a third party, unless overridden by the data subject's interests, rights and freedoms.
Legitimate interest is the most flexible lawful basis and therefore the one that demands the most documentation. GDPR Art. 6(1)(f) and EDPB guidance describe a three-part test: identify a legitimate interest that is lawful, real and present; show that the processing is necessary for it, with no less intrusive way available; and balance it against the data subject's interests, rights and reasonable expectations. The written record of that test is the legitimate interest assessment (LIA).
The LGPD (Art. 7, IX and Art. 10) adds that only data strictly necessary may be used, that transparency must be ensured, and that the ANPD may request a data protection impact report. Legitimate interest cannot be used for sensitive data under the LGPD.
Typical uses include fraud prevention, network security and some direct marketing. Using customer data to train an internal AI model may rely on legitimate interest, but the balancing must consider how expected the use is, safeguards such as pseudonymization and an easy way to object.
Where this term is assessed
Assessed in the Data Protection & AI Professional (DPAI), domain 1: Data protection foundations.
Also covered in: Responsible AI Practitioner (RAIP)
Primary sources
- GDPR Art. 6(1)(f) and Recital 47
- LGPD Art. 7, IX and Art. 10
- EDPB Guidelines 1/2024 on legitimate interest