Legitimate interest assessment (LIA)
The written three-part test showing why your legitimate interest, necessity, and safeguards outweigh the privacy impact.
What it is
A legitimate interest assessment is the written case for relying on GDPR Article 6(1)(f). It runs three checks: is the interest legitimate, is the processing genuinely necessary to pursue it, and do the person's rights and reasonable expectations outweigh it? That last balancing test records the likely impact and the safeguards that reduce it. Fraud prevention may survive this exercise; unrelated profiling hidden behind a vague claim of 'improving the service' probably will not.
Reach for an LIA before processing starts whenever legitimate interests is the proposed lawful basis, then revisit it when the purpose, data, audience, or technology changes. The useful version names the exact interest, tests less intrusive alternatives, documents evidence about user expectations, and assigns the promised safeguards to owners.
Gotcha: an LIA is not permission created by paperwork. If the processing is not necessary, or the impact still wins after safeguards, choose a different design or stop. Legitimate interests also does not supply the separate GDPR Article 9 condition required for special category data.
Ask AI for it
Draft a legitimate interest assessment under GDPR Article 6(1)(f) for the processing described below. Follow the ICO legitimate interests assessment template's three-part purpose, necessity, and balancing test. State the precise interest and who benefits; test whether a less intrusive technique can achieve it; document the data, people affected, their reasonable expectations, possible harms, and power imbalance; then list concrete safeguards, opt-out controls, retention limits, and owners. Give each claim an evidence field, score the residual impact, state a clear proceed, redesign, or stop decision, and flag any special category data that needs a separate Article 9 condition.