Legitimate Interest Assessments
How to write an LIA that actually stands up — purpose, necessity and balancing, without the legal jargon.
A good Legitimate Interests Assessment is short, specific, and honest about the balancing test. It is not a template exercise, and it is not a defensive document written for hypothetical regulators. It is a working record of the reasoning that supports a decision to rely on legitimate interests as a lawful basis, and it should read that way.
The three-part test is straightforward. The purpose test asks whether there is a legitimate interest being pursued. The necessity test asks whether the processing is necessary to achieve that purpose, or whether the interest could be achieved with less processing. The balancing test asks whether the interest is overridden by the interests, rights, or freedoms of the individuals whose data is being processed.
The purpose test is where most LIAs are too vague. "Business efficiency" is not a legitimate interest specific enough to assess. "Detecting fraudulent transactions in our payment platform to protect legitimate customers from financial loss" is. The specificity matters because it constrains the subsequent tests: the necessity test can only be answered against a specific purpose.
The necessity test is where most LIAs skip the important question. It is not enough to say that the processing is useful, or convenient, or aligned with the purpose. The question is whether the purpose could be achieved with less processing — less data, fewer recipients, shorter retention. Genuinely engaging with this question often produces an LIA that documents a narrower processing activity than the one originally proposed, which is a sign the assessment is working.
The balancing test is where most LIAs are too defensive. The regime does not require that legitimate interests always win. It requires an honest assessment of the impact on individuals, taking into account their reasonable expectations, the nature of the data, and the safeguards in place. An LIA that concludes the balance tips the other way is a good LIA — it just leads to a different lawful basis or a different processing decision.
Consider three common scenarios. Direct marketing to existing customers by email: legitimate interest is often available, subject to PECR consent for the electronic channel and a clear opt-out. Fraud prevention: legitimate interest is typically strong, provided the processing is proportionate and the data is not shared beyond what is necessary. Analytics on user behaviour to improve product design: legitimate interest can work, but only with clear transparency, meaningful controls for users, and honest assessment of whether the analytics are as anonymous as they claim to be.
Keep the assessment to two or three pages, name the person who signed it off, record the date, and set a review trigger. An LIA that has never been revisited since the day it was written is a red flag, because the processing it covers has almost certainly changed.
