What Is Legitimate Interest?
TL;DR
Legitimate interest is one of the six lawful bases for processing personal data under GDPR Article 6, and it allows processing for your own purposes without consent, provided a documented three-part test holds: a real interest, no less intrusive way to reach it, and no undue impact on the person whose data it is.
What is the three-part legitimate interests test?
The ICO frames it as three questions asked in order. The purpose test asks whether there is a genuine legitimate interest in the processing. The necessity test asks whether the processing is a targeted and proportionate way to achieve it, or whether the same result is reachable another way. The balancing test weighs the interest against the interests, rights and freedoms of the individual.
The output is a written legitimate interests assessment. It exists before the processing starts rather than after a complaint, and it is revisited when the purpose changes, because the accountability principle means the reasoning has to be recorded somewhere a regulator can read it.
Can cold outreach rely on legitimate interest?
Recital 47 says processing for direct marketing purposes may be regarded as carried out for a legitimate interest, so the basis is available in principle and is what most B2B outreach in the EU and UK relies on. The same recital sets the condition that decides most cases: whether the person could reasonably expect, at the time their data was collected, that it would be used this way.
Two limits sit on top and neither is removed by a strong assessment. Channel rules come from elsewhere, so PECR still requires consent for marketing email to an individual subscriber in the UK. And the objection right in Article 21(2) is absolute for direct marketing, so an objection ends the processing with no further balancing. That is the shape of the rule rather than advice on your own list, and the balancing test is the part a regulator will actually read.
What makes a balancing test fail?
Surprise is the usual cause. Data scraped from a source with no relationship to the sender, contacts approached about something unrelated to their role, volume out of proportion to the interest claimed, or an opt-out that is harder than the message was to send. Any of these makes it difficult to argue the person could reasonably expect the processing.
Special category data is a harder stop. Article 9 requires a separate condition on top of the Article 6 basis, and legitimate interest is not one of them, so health, political or similar data cannot be processed for marketing on this basis at all.
Frequently asked questions
No. It is a different basis with its own conditions and its own paperwork, and in one respect it is weaker: an objection to direct marketing under Article 21(2) stops the processing immediately, with no balancing test to fall back on. Consent, once given, at least remains valid until withdrawn.