Legitimate interests

Legitimate interests is one of the six lawful bases for processing personal data. It applies when processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Controllers must carry out a three-part test: identify the legitimate interest, show processing is necessary, and balance it against the data subject's interests.