💭 Ask yourself...

"Am I trying to decide whether legitimate interests applies, or am I trying to justify a decision I've already made?"

The answer to that question often determines the quality of the assessment.

Short answer

A Legitimate Interests Assessment (LIA) isn't there to justify processing.

It's there to help you decide whether legitimate interests is the most appropriate lawful basis.

A good LIA should demonstrate that you've genuinely considered both your organisation's interests and the potential impact on the individuals whose information you're using.

Why is this important?

Legitimate interests is one of the most flexible lawful bases under UK GDPR.

That flexibility sometimes leads organisations to believe it can be used whenever another lawful basis feels inconvenient.

That's not the purpose of legitimate interests.

An LIA should provide evidence that you've carefully considered:

• the benefit to your organisation; 
• whether the processing is necessary; 
• the impact on individuals; 
• whether that impact can be reduced. 

The outcome shouldn't be decided before the assessment begins.

A genuine balancing exercise

A strong LIA isn't about proving your organisation is right.

It's about asking honest questions.

For example:

• Is there another, less intrusive way to achieve the same objective? 
• Would people reasonably expect this use of their information? 
• Could anyone be disadvantaged? 
• Have we introduced safeguards to reduce the impact? 
• If I were the individual, would I consider this use of my information to be fair? 

Sometimes the answer will be that legitimate interests is appropriate.

Sometimes it won't.

Both outcomes demonstrate good accountability.

What about the Data (Use and Access) Act?

The Data (Use and Access) Act has introduced changes to the way certain legitimate interests can be relied upon in specific circumstances.

However, these changes do not mean that organisations can automatically rely on legitimate interests whenever it suits them.

For most day-to-day business activities, organisations should still identify an appropriate lawful basis, consider the impact on individuals and document their reasoning where an LIA is required.

The principles of fairness, transparency and accountability remain just as important.

An LIA should evolve

An LIA shouldn't be completed once and forgotten.

If your processing changes...

• your technology changes; 
• your audience changes; 
• your purpose changes; 
• your risks change... 

...your assessment should be reviewed.

Like a DPIA, an LIA should reflect how your organisation actually operates today—not how it operated two years ago.

Practical steps

1. Clearly identify the processing activity. 
2. Define the legitimate interest you're seeking to achieve. 
3. Consider whether the processing is genuinely necessary. 
4. Carry out an honest balancing exercise. 
5. Identify safeguards that reduce any impact. 
6. Record your reasoning. 
7. Review the assessment if the processing changes. 

Common Misconceptions

❌ "Legitimate interests is the easiest lawful basis."

Not necessarily.

It is one of the most flexible lawful bases, but it still requires careful thought and, where appropriate, a documented Legitimate Interests Assessment.

❌ "The LIA is there to prove I can do what I want."

No.

An LIA should be an objective assessment. It should challenge your thinking, not simply document a decision you've already made.

❌ "If the business benefits, legitimate interests automatically applies."

Not correct.

A business benefit is only one part of the assessment. You must also consider necessity, the impact on individuals and whether their interests override your own.

❌ "The Data (Use and Access) Act means I don't need an LIA anymore."

Not generally.

While the Act has introduced changes in certain areas, it hasn't removed the need to think carefully about why you're relying on legitimate interests or to demonstrate accountability where appropriate.

❌ "Once I've completed my LIA, it's finished."

Not necessarily.

If the processing activity changes, your assessment should be reviewed to ensure it still reflects reality.

🤝 Need a little support?

Legitimate interests is often one of the most useful lawful bases available to organisations—but only when it's applied thoughtfully.

A good LIA isn't about finding reasons to support a preferred outcome. It's about asking the right questions, documenting your reasoning and demonstrating that you've reached a balanced decision.

If you're unsure whether legitimate interests is appropriate, or you'd like an independent review of your assessment, we're happy to help.

Related Guides:

Do My Data Protection Policies Actually Reflect My Business? 

How Do I Keep Track of All the Personal Data? 

We've Completed a DPIA... Is That It?