Legitimate interests is the most flexible lawful basis under the GDPR and UK GDPR, and the one most often claimed without the written assessment that shows the controller actually weighed people's rights against its own interest. Article 6(1)(f) allows processing that is necessary for a legitimate interest unless the interests or fundamental rights of the people concerned override it, and the accountability principle in Article 5(2) means you must be able to show how you reached that view. This template gives privacy leads, data protection officers and the security and product teams who rely on legitimate interests a legitimate interests assessment (LIA) they can complete per processing activity: the three-part test, the questions to answer, a decision record and a worked example for security monitoring. Higher risk processing also needs a DPIA, covered in the DPIA Template; this page covers the LIA only.
How to use this template
- Complete one LIA per processing activity, defined by purpose, matching the activity in your record of processing. See the Record of Processing Activities (ROPA) Template.
- Complete it before the processing starts. The ICO says the UK GDPR does not require an LIA, but that you should do one anyway whenever you rely on legitimate interests.
- Answer every question in sections 4 to 7 in writing, including points that weigh against the processing. The ICO's guidance is to record all relevant factors and keep an audit trail, not only the conclusion.
- Replace text in square brackets, such as [Organisation], [Activity name] and [Review date], with your own values. Delete the guidance notes in italics once completed.
- If section 6 identifies a likely high risk, or the screening questions in section 6.4 are met, stop and complete a DPIA before proceeding.
- Section 11 is a worked example for internal security monitoring. Use it to calibrate the level of detail, not as a substitute for your own facts.
1. Purpose of this assessment
This assessment records how [Organisation] decided that legitimate interests under Article 6(1)(f) of the [GDPR / UK GDPR] is the appropriate lawful basis for [Activity name]. It identifies the interest pursued, shows that the processing is necessary for it, and balances it against the interests, rights and freedoms of the people whose data is processed. It is kept as evidence of compliance with the accountability principle in Article 5(2).
2. Assessment details
| Field | Entry |
|---|---|
| LIA reference | [LIA-YYYY-NNN] |
| Processing activity and ROPA reference | [Activity name] / [ROPA ID] |
| Activity owner | [Name, role] |
| Assessor and DPO or privacy lead consulted | [Names, date] |
| Controller (and any joint controller) | [Legal entity] |
| Jurisdictions and regimes | [EU GDPR / UK GDPR / other] |
| Categories of personal data | [For example identifiers, contact details, device and log data] |
| Categories of data subjects | [Employees, customers, prospects, website visitors, children] |
| Systems and processors involved | [Systems, processors] |
| Planned start date | [Date] |
3. Is legitimate interests the right basis?
Guidance: legitimate interests should not be used to avoid a basis that fits better. Answer each question; if any answer points elsewhere, record why legitimate interests still applies or switch basis.
- Public authority tasks: Article 6(1) states that point (f) does not apply to processing carried out by public authorities in the performance of their tasks. Is [Organisation] a public authority acting in that capacity? [Yes / No]
- Contract or legal obligation: is the processing necessary to perform a contract with the person (Article 6(1)(b)) or to comply with a legal obligation (Article 6(1)(c))? If so, use that basis. [Answer]
- Consent: would people expect to be asked, and could they genuinely refuse? If consent is required by other law, for example for cookies and similar technologies under ePrivacy rules, legitimate interests cannot replace it. [Answer]
- Special category or criminal offence data: legitimate interests can only cover the Article 6 basis. Special category data also needs an Article 9 condition, and criminal offence data needs authority under Article 10. Record the additional condition here. [Condition]
- UK only, recognised legitimate interest: since 5 February 2026 the UK GDPR includes Article 6(1)(ea), recognised legitimate interest, for the conditions in Annex 1 (disclosure for a public task request, national security, public security and defence, emergencies, crime, and safeguarding vulnerable individuals). Does one of these apply? If so, record it and consider whether that basis fits better. [Answer]
4. Purpose test: is there a legitimate interest?
| # | Question | Answer |
|---|---|---|
| 4.1 | What is the interest? State it specifically, for example "detecting unauthorised access to our systems", not "business purposes". | [Answer] |
| 4.2 | Whose interest is it: [Organisation]'s, a third party's, or the wider public's? How important is the benefit to each? | [Answer] |
| 4.3 | Is the interest lawful? Does the processing comply with other law, sector rules, industry guidance and ethical standards? | [Answer] |
| 4.4 | Is the interest real and present, rather than speculative? | [Answer] |
| 4.5 | What would the impact be if the processing did not go ahead? | [Answer] |
| 4.6 | Do the recitals or the law name this kind of interest? Recital 47 mentions fraud prevention and direct marketing; Recital 48 mentions intra-group transmission for internal administrative purposes; Recital 49 mentions network and information security. In the UK, Article 6(11) lists direct marketing, intra-group transmission and network and information security as examples. | [Answer] |
Guidance: a named example does not settle the test. The ICO warns against assuming that a purpose listed as an example is enough on its own; the necessity and balancing tests still apply. A commercial interest can be legitimate, provided it is lawful.
5. Necessity test: is the processing needed?
| # | Question | Answer |
|---|---|---|
| 5.1 | How does the processing achieve the purpose in 4.1? Describe the link. | [Answer] |
| 5.2 | Is it proportionate, or does it collect or use more than the purpose needs? | [Answer] |
| 5.3 | Could the purpose be met without personal data, with less data, with pseudonymised or aggregated data, or with a shorter retention period? | [Answer] |
| 5.4 | If a less intrusive option exists, why is it not reasonable to use it? | [Answer] |
| 5.5 | Which data fields will not be collected or will be removed as a result of this test? | [Answer] |
6. Balancing test: do people's interests override yours?
6.1 Nature of the data
- Does the processing include special category data, criminal offence data or other data people treat as private, such as financial or location data? [Answer]
- Does it involve children or other people in a vulnerable position? [Answer]
- Is the data about people in their personal or professional capacity? [Answer]
6.2 Reasonable expectations
- What is the relationship with the people concerned (employee, customer, no relationship)? [Answer]
- How and when was the data collected, and what were people told at that point? [Answer]
- Is the use obvious from the context, or new or unexpected? Has technology or context changed since collection? [Answer]
- Is there evidence about expectations, such as surveys, complaints or sector practice? [Answer]
Guidance: the ICO describes the expectations test as objective: you need to show that a reasonable person would expect the processing, not that every individual does.
6.3 Likely impact
| Possible impact | Likelihood (low, medium, high) | Severity (low, medium, high) | Notes |
|---|---|---|---|
| Loss of control over personal data | [ ] | [ ] | [ ] |
| Barriers to exercising rights or accessing services | [ ] | [ ] | [ ] |
| Financial loss or fraud | [ ] | [ ] | [ ] |
| Distress, chilling effect or reputational harm | [ ] | [ ] | [ ] |
| Physical harm or discrimination | [ ] | [ ] | [ ] |
| Data breach exposure from the new dataset | [ ] | [ ] | [ ] |
6.4 DPIA screening
Does the processing involve systematic monitoring, large scale special category data, profiling with significant effects, innovative technology, data matching, invisible processing, tracking or children's data as a target? If any apply, record which and complete a DPIA. See the DPIA Guide: Running a Data Protection Impact Assessment. [Answer]
7. Safeguards
List the safeguards that reduce the impact identified in section 6. The ICO notes that safeguards can change the balance but do not always justify the processing, and that offering an opt-out does not turn the basis into consent.
| Safeguard | Applied? | Detail |
|---|---|---|
| Data minimisation and field exclusion | [Yes / No] | [ ] |
| Pseudonymisation or aggregation before analysis | [ ] | [ ] |
| Short, enforced retention | [ ] | [Period] |
| Access restricted by role, with logging of access | [ ] | [ ] |
| Simple opt-out or objection route | [ ] | [ ] |
| Human review before any decision affecting a person | [ ] | [ ] |
| Security measures under Article 32 | [ ] | [ ] |
| Processor contract terms under Article 28 | [ ] | [ ] |
8. Outcome and decision
| Field | Entry |
|---|---|
| Purpose test met? | [Yes / No, with reason] |
| Necessity test met? | [Yes / No, with reason] |
| Balancing outcome | [Interests not overridden / overridden / not overridden with safeguards in section 7] |
| Decision | [Proceed / Proceed with conditions / Do not proceed / Complete DPIA first] |
| Conditions attached | [ ] |
| Decision maker and date | [Name, role, date] |
| DPO or privacy lead view | [Agree / Disagree, with comments] |
9. Transparency and the right to object
- Privacy information: Articles 13(1)(d) and 14(2)(b) require the privacy notice to state the legitimate interests pursued. Record the notice section and wording: [Reference].
- Right to object: under Article 21(1) people can object to processing based on point (f), and the controller must stop unless it shows compelling legitimate grounds that override the person's interests, rights and freedoms, or the processing is for legal claims. In the UK this right also covers point (ea). Record how objections are received and handled: [Process].
- Direct marketing: under Article 21(2) and (3) an objection to direct marketing is absolute; the processing for that purpose must stop. Record the suppression mechanism: [Mechanism].
10. Review and sign-off
- Review this LIA every [12 months], and earlier if the purpose, data, systems, recipients or context change, or if a complaint, objection trend or incident suggests a new impact.
- Version history: [Version, date, change, approver].
- Approved by: [Name, role, date].
11. Worked example: security log monitoring of staff accounts
| Section | Example entry |
|---|---|
| Interest (4.1) | Detecting and responding to unauthorised access, account takeover and data exfiltration on [Organisation]'s identity platform and endpoints. Recital 49 names network and information security as a legitimate interest. |
| Data | Sign-in events, IP address, device ID, user agent, directory change records, endpoint alerts. No message content. |
| Necessity (5.3) | Account takeover cannot be detected from aggregated data, so user-level events are needed. Content of email and files is excluded; browsing history is excluded except for security alerts. |
| Expectations (6.2) | Staff are told in the IT acceptable use policy and staff privacy notice that security logs are collected and reviewed. Monitoring of this kind is widely expected in employment. |
| Impact (6.3) | Low to medium: risk of misuse of logs to monitor performance. Mitigated by purpose restriction and access control. |
| Safeguards (7) | Access limited to the security team, every query logged, 12-month retention, no use for performance management without a separate assessment, human review before any disciplinary step. |
| DPIA screening (6.4) | Systematic monitoring of employees: DPIA completed and referenced. |
| Decision (8) | Proceed with conditions: purpose restriction recorded in the logging standard and checked at annual review. |
For the security controls this example relies on, see the GDPR Compliance Guide for Security Teams.
Standards and references
- GDPR: Article 6, Lawfulness of processing
- GDPR: Article 21, Right to object
- ICO: How do we apply legitimate interests in practice?
- UK legislation: Data (Use and Access) Act 2025, section 70, Lawfulness of processing
- UK legislation: Data (Use and Access) Act 2025, Schedule 4, Recognised legitimate interests
- EDPB: Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
Implementation guidance
- Find the activities first: filter your record of processing for every activity whose lawful basis is legitimate interests. Each one needs an LIA; prioritise those with large volumes, children, monitoring or new technology.
- Assign owners: the activity owner completes sections 2 to 7; the privacy lead challenges and records a view in section 8. Security teams usually own the facts for monitoring, fraud and logging activities.
- Link the records: store the LIA reference in the ROPA row and the privacy notice reference in section 9, so a change to one prompts review of the others.
- Gate new processing: add "LIA completed or not required" to project intake and change approval so legitimate interests is never chosen after launch.
- Measure: share of legitimate interests activities with a current LIA, LIAs past their review date, objections received and upheld per activity, and LIAs that triggered a DPIA.
- Small versus large organisations: a small organisation may have five to ten LIAs and can keep them as documents. A larger group should keep them in the same tool as the ROPA and DPIAs, with workflow for review dates.
- EU and UK operations: where both regimes apply, complete one LIA and note any UK-only element, such as reliance on recognised legitimate interest or the Article 6(11) examples, in section 3.
This template summarises Article 6(1)(f) of the GDPR and UK GDPR and related ICO guidance, and is not legal advice. Related NHI Mgmt Group resources: DPIA Template · Record of Processing Activities (ROPA) Template · GDPR Compliance Checklist · Data Mapping and ROPA Guide