ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXA GDPR lawful basis under Article 6(1)(f), explained with the 3-part test, an LIA checklist, and how it differs from consent and India's DPDPA.
An organisation relying on legitimate interest must be able to justify why the processing is lawful, necessary, and proportionate. A legitimate interest assessment (LIA) is commonly used to document this analysis.
Important: Legitimate interest is not a blanket exemption from consent requirements. In particular, using legitimate interest does not automatically permit non-essential cookies, advertising trackers, or other technologies where applicable ePrivacy rules require consent.
Legitimate interest means an organisation has a genuine and lawful reason to use personal data, the processing is necessary for that reason, and people's privacy rights do not outweigh it.
Common examples include:
Even when your interest is valid, you must protect people's privacy. Collect only the data you need, keep it for as short a time as possible, tell people clearly what you are doing, and let them object. Being commercially useful does not make an activity a legitimate interest, so each case needs its own check.
Yes.
Article 6(1)(f) of the GDPR recognises legitimate interests as one of the lawful bases for processing personal data.
It applies when:
These conditions are cumulative. All three need to be satisfied.
Legitimate interest and contractual necessity are separate lawful bases.
Processing is necessary to perform a contract with the individual or take steps at their request before entering into a contract.
Processing is necessary for a legitimate interest, subject to the three-part balancing test.
An organisation should not use contract as a basis merely because the processing is useful to its business.
Likewise, legitimate interest should not be used when contractual necessity is the more appropriate basis.
The lawful basis should reflect the actual purpose and necessity of the processing.
A legal obligation applies where processing is necessary to comply with a legal requirement imposed on the organisation.
Legitimate interest is different.
For example:
processing required by applicable law.
processing necessary for a legitimate business, security, operational, or third-party interest that survives the balancing test.
Choosing the correct lawful basis matters because the associated rights and compliance requirements can differ.
The core of legitimate interest is a three-part assessment.
First, identify the legitimate interest.
Ask:
Possible interests can include commercial, individual, operational, security, or broader societal interests.
The interest should be clearly articulated rather than described in vague terms such as “business purposes.”
Next, determine whether processing personal data is actually necessary to achieve that interest.
Ask:
If an equally effective and less privacy-intrusive method is reasonably available, legitimate interest may not be an appropriate basis.
The necessity test therefore does not simply mean that processing is convenient.
Finally, balance the organisation's legitimate interest against the individual's interests, rights, and freedoms.
Consider:
If the individual's interests, rights, or freedoms override the organisation's legitimate interest, Article 6(1)(f) cannot be relied upon for that processing.
A Legitimate Interest Assessment (LIA) is a documented assessment used to determine whether legitimate interest is an appropriate lawful basis for a particular processing activity.
A good LIA should normally document:
The assessment should be performed before relying on legitimate interest for the processing.
The ICO describes an LIA as a light-touch risk assessment based on the specific circumstances of the proposed processing and recommends documenting the outcome.
Yes.
A documented LIA helps demonstrate why legitimate interest was selected and how the organisation assessed the processing.
The record should not be a generic template copied across unrelated processing activities.
A useful LIA should be specific to:
The ICO recommends documenting the outcome of the three-part assessment and doing so before processing begins.
Before relying on legitimate interest, ask:
When relying on legitimate interest, organisations should explain the relevant legitimate interests in their privacy information.
The privacy notice should not simply state:
“We process your information based on legitimate interest.”
It should provide meaningful information about the legitimate interest being pursued.
This helps individuals understand:
The EDPB's guidance states that controllers relying on Article 6(1)(f) should inform data subjects of the legitimate interests pursued.
Legitimate interest is a lawful basis under Article 6(1)(f) of the GDPR and the UK GDPR. Under both laws you must pass the purpose, necessity and balancing tests, and the ICO recommends a documented Legitimate Interest Assessment (LIA) before you start. However, it works differently under other rules. ePrivacy and PECR cookie rules are separate, so having a legitimate interest does not remove the need for consent for non-essential cookies and trackers. India's DPDPA has no GDPR-style legitimate interest. It allows only "certain legitimate uses" under Section 7, which are specific and fixed. California's CCPA / CPRA has no lawful bases at all, and instead gives people the right to opt out of the sale and sharing of their data. If your website serves visitors in more than one region, check each law separately and apply region-specific rules, because a lawful basis that works under GDPR may not exist elsewhere and never replaces cookie consent where ePrivacy rules require it.
India's Digital Personal Data Protection Act, 2023 (DPDP Act) uses a different structure from GDPR.
The Act provides that personal data may be processed for a lawful purpose based on:
Section 7 defines these “certain legitimate uses” and lists specific circumstances in which a Data Fiduciary may process personal data.
This is an important distinction.
The GDPR concept of legitimate interest under Article 6(1)(f) should not simply be copied into an Indian DPDPA compliance framework.
Instead:
legitimate interest is a specific lawful basis under Article 6(1)(f).
“certain legitimate uses” are specific statutory grounds under Section 7.
ConsentX should preserve this distinction throughout its India-focused content.
Section 7 includes specific circumstances such as processing personal data for a specified purpose for which the Data Principal voluntarily provided the data and has not indicated non-consent.
The Act also provides other categories of legitimate use involving areas such as:
The precise conditions depend on the applicable provision and circumstances.
Therefore, ConsentX should avoid describing the DPDPA as simply having a GDPR-style “legitimate interest” lawful basis.
This distinction is especially important for organisations operating in both Europe and India.
No, not generally.
Legitimate interest can sometimes be an alternative lawful basis under GDPR for a particular processing activity, but it does not override other legal requirements.
This distinction is especially important for websites.
For example, an organisation might have a legitimate interest in maintaining website security. That does not automatically mean it can place every analytics or advertising cookie without consent.
Cookie and electronic-communications rules can impose additional requirements beyond the GDPR lawful basis analysis.
Therefore:
GDPR lawful basis ≠ automatic permission to place cookies or tracking technologies.
This is one of the most important distinctions for privacy teams to understand.
Legitimate interest should not be used as a blanket justification for non-essential cookies.
For example, a website cannot simply label an advertising tracker as “legitimate interest” and assume that the tracker can load before consent where applicable cookie/ePrivacy rules require prior consent.
A proper analysis should separately consider:
This distinction prevents organisations from confusing GDPR lawful basis with cookie-storage/access requirements. In practice, a cookie consent banner with prior-script blocking keeps those trackers from loading until consent is given.
A Consent Management Platform (CMP) primarily manages consent preferences and consent records.
It does not automatically determine whether an organisation can rely on legitimate interest.
A CMP may help with:
But an organisation should separately document its lawful-basis analysis.
For legitimate interest, this may include maintaining an LIA alongside the relevant privacy and processing records.
Analytics can involve several different processing activities.
An organisation should not automatically classify all analytics as legitimate interest.
Consider:
A low-impact internal analytics activity may have a different legal analysis from behavioural tracking across websites and services.
The lawful basis should therefore be assessed based on the actual implementation.
Fraud prevention is a commonly considered legitimate interest.
An organisation may have a strong interest in detecting:
However, fraud prevention is not automatically lawful simply because the organisation describes it as security-related.
The organisation should still assess necessity, proportionality, impact, reasonable expectations, and applicable safeguards.
Direct marketing can sometimes rely on legitimate interest under GDPR/UK GDPR, but this requires a context-specific analysis and may be subject to additional electronic-marketing rules.
The ICO notes that legitimate interest can apply to direct marketing where applicable electronic-communications rules do not require consent, provided the processing is proportionate, has a minimal privacy impact, and is not unexpected or likely to cause unjustified objection.
For this reason, a company should not treat:
“We have a legitimate interest in marketing”
as sufficient justification by itself.
It should separately consider:
Profiling can sometimes be based on legitimate interest, but the analysis becomes more important as the impact on individuals increases.
Consider:
A legitimate interest assessment should reflect the actual consequences of the profiling rather than treating profiling as ordinary processing.
Individuals retain important rights even when processing is based on legitimate interest.
Under GDPR, an individual can object to processing based on Article 6(1)(e) or 6(1)(f) on grounds relating to their particular situation.
If the objection is to direct marketing, the right to object is stronger: the personal data must no longer be processed for direct marketing purposes.
This means organisations relying on legitimate interest should have processes for:
Children require particular care.
Under GDPR Article 6(1)(f), the rights and freedoms of the data subject, particularly where the person is a child, are expressly relevant to the legitimate-interest analysis.
Processing involving children may therefore require stronger safeguards and a more cautious balancing assessment.
An organisation should not assume that a legitimate interest that is acceptable for adults automatically remains appropriate for children.
Legitimate interest under Article 6(1)(f) is not by itself sufficient to process special category data under GDPR.
Where special category data is involved, an organisation generally needs:
The analysis may therefore require additional legal safeguards.
Similarly, criminal-offence data has additional requirements.
Legitimate interest can be a lawful basis under GDPR, but additional laws may still require consent for particular technologies or communications.
Simply writing “legitimate interest” in a privacy policy is not the same as performing the three-part test.
A legitimate-interest assessment should reflect the actual processing and context.
Whether people would reasonably expect the processing is an important part of the balancing exercise.
If the same objective can reasonably be achieved with less personal-data processing, necessity may fail.
A business benefit does not automatically override an individual's rights and freedoms.
A GDPR lawful basis does not automatically override applicable cookie or ePrivacy requirements.
The two frameworks use different legal structures and should be analysed separately.
ConsentX keeps your consent evidence separate from processing that relies on another lawful basis, so it is always clear which activities depend on a person's choice.
With ConsentX you can record:
This distinction is particularly important for websites using analytics, advertising, personalisation, and other third-party technologies.
ConsentX helps organisations manage consent, privacy preferences, consent records, and audit evidence across privacy frameworks, so teams can distinguish processing that requires consent from processing based on another lawful basis. The organisation remains responsible for determining and documenting its lawful basis.