Aristotelis Zervos
Aristotelis Zervos, Editorial Director at 2B Advice, combines legal and journalistic expertise in Data protection, IT-Compliance and AI regulation.
In practice, legitimate interest is often the „all-purpose“ legal basis and at the same time one of the most error-prone. Anyone who uses Art. 6 para. 1 lit. f GDPR must clearly justify in advance why there is a legitimate interest in the planned use of the Processing is required for this and why, in the end, there are no overriding rights of the data subjects to the contrary. The article systematically guides you through the three-stage test for determining the legitimate interest based on the questionnaire of the Hamburg Commissioner for Data Protection and Freedom of Information and uses practical examples (including direct marketing and Video Surveillance), how a sound balancing of interests is structured, documented, and implemented in the Compliance-is implemented in a way that is consistent with best practices.
Legitimate Interest as a "Swiss Army Knife" Under the GDPR
Art. 6 para. 1 lit. f GDPR opens up a flexible legal basis for companies and authorities to Processing personal data, provided that legitimate interests of the controller or a third party, and there are no overriding interests or fundamental rights of the data subjects that would preclude this. However, this balancing clause requires a careful assessment on a case-by-case basis.
Already the Federal Constitutional Court (BVerfG) betonte im Volkszählungsurteil 1983, dass Eingriffe in das Recht auf Informational self-determination are only permissible in the overriding public interest on the basis of a proportionate law. Accordingly, the European legislator has introduced the three-step test in Art. 6 para. 1 lit. f GDPR which is intended to ensure that every Processing in accordance with the law and proportionate to the legitimate interest.
In practice, you must Responsible persons check the documentation in advance,
- whether there is a legitimate interest,
- whether the Processing is required for this, and
- whether the interests or fundamental rights of the individuals concerned do not, after all, take precedence.
On January 6, 2026, the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) published a questionnaire that lists criteria for each stage and facilitates a structured balancing of interests. The three assessment steps are systematically explained below and illustrated with practical examples.
Existence of a legitimate interest
The first step is to determine what interest the Responsible persons or a third party with the planned data processing. Art. 6 para. 1 lit. f GDPR expressly mentions both the controller's own interests and the interests of third parties (natural or legal persons, authorities, etc., see Art. 4 No. 10) GDPR). The decisive factor is that it is a „legitimate“ interest. This term is to be understood broadly: It can be of a legal, economic, non-material or factual nature. In principle, a wide range of interests can be considered, such as economic interests (e.g. increasing efficiency, reducing costs), security interests (protection against fraud, theft or cyber attacks) or social/internal interests (maintaining network security, quality assurance, customer care). However, some qualification criteria must be met for an interest to be recognized as „legitimate“:
- Legitimacy and Compliance with the Law: The interest pursued must be legitimate. Interests that violate applicable EU law or the law of a Member State are not legitimate per se. For example, an „interest“ in discriminatory use of data or in general Data retention Without a purpose, it is impermissible.
- Clarity and Precision: The interest and specific purpose of the Processing must be formulated concretely and precisely. In the third step, only a clearly defined interest can be meaningfully compared against the Rights of data subjects Weigh the options. Vague or general statements („any business purposes“) are not sufficient.
- Timeliness and Relevance to Reality: The interest must be genuine and current, not merely speculative or hypothetical. A benefit that is merely possible and lies in the distant future does not justify current data processing. Example: Storing customer data „just in case“ for as-yet-undetermined future business ideas would not constitute a legitimate interest.
If these conditions are met, one can assume that there is a legitimate (i.e., lawful and worthy of protection) interest. Typical examples can be found in the recitals: For instance, Recital 47 explicitly mentions direct marketing as a possible case of a legitimate interest. A company may therefore generally assume that its interest in direct marketing (particularly toward existing customers) may be legitimate.
6 Questions on legitimate interest
What is the purpose of the data processing activity?
This is about the general benefit that is expected from the processing activity, such as the „marketing of products“. Recitals 47 to 49 of the GDPR contain examples of legitimate interests.
What is the specific purpose of the planned processing?
This refers to the purpose or specific reason for the planned data processing. Example: Direct marketing to the company’s own customers via mail (e.g., a promotional catalog).
Who is following the interest?
Art. 6 para. 1 lit. f GDPR includes own and third-party (third) Interests. „Third party“ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data, Art. 4 No. 10 GDPR.
Is this interest legitimate, and does it not violate applicable law?
Interests that violate applicable EU law or the law of a Member State are not permitted.
Is the interest stated clearly and precisely?
The scope of the legitimate interest being pursued must be clearly defined so that it can be weighed against the interests and fundamental rights of the data subject in the third step.
Is the interest genuine and current?
Speculative or hypothetical interests cannot be properly assessed and therefore cannot justify data processing. Example: A Data retention for future business ideas that have not yet been fully developed.
Necessity of the processing
If there is a legitimate interest, the second step is to Necessity and appropriateness of the planned Processing be examined for the pursuit of this interest. Art. 6 para. 1 lit. f GDPR requires that the Processing „is “necessary for the purposes of the legitimate interests". This reflects the general principle of proportionality: the measure must be suitable and necessary to achieve the legitimate objective. And it must not disproportionately interfere with the rights of the data subjects.
The key questions at this stage are: Is this specific data even needed for the purpose? And if so, is there no milder means of realizing the legitimate interest just as effectively? The wording of the GDPR and the principle of Data minimization (Art. 5 para. 1 lit. c GDPR) set the direction here: Only appropriate, relevant and absolutely necessary data may be processed. If an equally effective but less intrusive method exists, this must be chosen. Examples of milder means can be Anonymization or Pseudonymization the data, the use of synthetic test data instead of actual personal data, or the limited analysis of samples rather than a complete census.
Another element of the Necessity is the scope limitation of the ProcessingThe planned measure should be kept as small and targeted as possible. In concrete terms, this means: data scope, group of persons and duration of the Processing should be reduced to the necessary minimum. Particular attention should also be paid to the storage period: Personal data may be retained only for as long as is necessary for the intended purpose. A Fire Suppression Plan with defined deadlines is essential. Once the purpose has ceased to exist, there is an obligation to erase (Art. 17 para. 1 lit. a GDPR; Recital 39). Example: With Video Surveillance on a company's premises, the Necessity be limited by the fact that the recordings are automatically overwritten after a short period of time (e.g., 48 hours), provided that no security-related incident has been detected.
The necessity test forces the person responsible to Processing critically scrutinized.
7 Questions on the necessity of processing
Is the processing absolutely necessary to achieve the interest or can milder means also be considered?
There must be no less severe, less intrusive measures available. Alternatives must be considered. Example: Anonymization, Pseudonymization, synthetic data instead of real data.
Is the data to be processed limited to what is necessary?
The principle of Data minimization must be observed, Art. 5 para. 1 lit. c GDPR. Only data that is appropriate, relevant and necessary for the specific purpose may be processed. In particular, the Processing of sensitive data (Art. 9 GDPR) is only permitted in narrow, legally regulated exceptional cases (Art. 9 para. 2 GDPR) allowed.
Is the number of individuals affected limited to the minimum necessary to achieve the purpose?
Example: Limiting the number of data records, using samples instead of complete surveys, Anonymization.
Is the data processing one-off or continuous?
With continuous Processing the Necessity be permanent. Once a legitimate interest has been established, it does not automatically justify ongoing Processing of data.
Are all processing steps necessary for this purpose, or can some of them be omitted?
Each processing step must be considered and evaluated individually.
Is there a data retention policy? Is the retention period defined?
Personal data may only be stored for as long as they are necessary for the intended purpose (Rec. 39 and Art. 17 para. 1 lit. a GDPR). Once the purpose has ceased to exist, there is generally a deletion obligation. In contrast, there are statutory retention periods, e.g. from the German Commercial Code (HGB), the German Fiscal Code (AO), the German Income Tax Act (EStG), social security law or the German Industrial Code. The storage period should be documented for each data category and automated deletion processes should be in place.
Is there an overview of existing and planned data flows?
The data flow must also be Third be comprehensible and transparent. A data flow diagram is used for your own illustration and for accountability and illustration to management, customers, affected persons, supervisory authorities, etc.
Balancing of Interests: Do the Interests of the Affected Parties Prevail?
Only when a legitimate interest has been identified and the measure has been qualified as necessary for this purpose does one reach the decisive balancing according to Art. 6 para. 1 lit. f half-sentence 2 GDPRDo the interests, fundamental rights and freedoms of the data subject outweigh the interests of the controller? This third The second review step ensures that even in the case of legitimate objectives and necessary data processing, the interests of the data subjects worthy of protection are not disproportionately impaired. This involves a comprehensive assessment of all circumstances of the individual case. Recital 47 sentence 1 emphasizes that the reasonable expectations of the data subject based on their relationship with the controller must be taken into account. As a result, the Processing only take place if the scales do not tip in favor of the parties concerned. Otherwise, the Processing unlawful.
Case law (particularly that of the European Court of Justice and national courts) and regulatory authorities have developed numerous criteria that are taken into account in the balancing of interests. An overall assessment is made based on these criteria. No single criterion is decisive on its own; rather, a comprehensive balancing of interests must be carried out. The legitimate interests of the controller are weighed against the impacts on the data subjects. Ultimately, this assessment resembles a proportionality test in the narrower sense (weighing the severity of the interference against the importance of the purpose). Recital 47 stipulates that public authorities should not rely on Article 6(1)(f) when performing their public tasks. Otherwise, the following applies: The more significant the interest and the less severe the intrusion, the more likely the controller’s interest will prevail.
Reading tip: Smart Data Protection Impact Assessment in Ailance
Fundamental rights, freedoms and interests of the data subjects
Which fundamental rights of the individuals concerned are affected?
Right to Privacy, Data Protection, non-discrimination, liberty and security, freedom of expression and information, freedom of thought, conscience, and religion, freedom of assembly and association, the prohibition of discrimination, the right to property, and the right to physical and mental integrity, among others.
Are the fundamental freedoms of the individuals concerned affected?
These include the free movement of goods, the free movement of workers, the freedom of establishment, the freedom to provide services, and the free movement of capital and payments under the TFEU.
Are the „interests“ of the individuals concerned taken into account in addition to their fundamental rights and freedoms?
This includes all interests that are affected by the Processing could be impaired.
- Financial interests: e.g., protection against impacts on investments, earning potential, retirement savings, credit ratings, and insurance coverage.
- Social interests: e.g., protection of the social sphere, damage to reputation, discrimination, unwanted contact
- Personal interests: e.g., protection of intimate and Privacy by processing data in connection with a person's sex life or sexual orientation
Type of personal data
What type of data should be processed?
In what capacity are these individuals affected? Example: In their personal or professional capacity.
Are these special categories of personal data (Art. 9 GDPR)?
This sensitive data includes, in particular:
- Ethnic origin and race
- political opinions
- religious or ideological beliefs
- Union membership
- Genetic and biometric data (e.g. fingerprint)
- Health data
- Data on a person's sex life or sexual orientation
If this data is processed, the potential interests of the data subjects are generally given a high weighting in the consideration. In addition, the requirements of Art. 9 para. 2 GDPR be fulfilled. Even if there is an exception pursuant to Art. 9 para. 2 GDPR the balancing of interests of Art. 6 para. 1 lit. f GDPR nevertheless turn out in favor of the interests of the data subject (see ECJ of 21 December 2023 (case C-667/21)).
Is it data from children?
The best interests of the child must be a primary consideration in all measures concerning children. All rights must be taken into account here, not just data protection rights, cf. rec. 38 on the GDPR.
Does this involve data on criminal convictions and offenses pursuant to Article 10 of the GDPR?
This data (including the certificate of good conduct) is also particularly worthy of protection. A Processing should only take place under official supervision or if it would be permitted under Union or national law.
Is it private data?
Some data is considered particularly sensitive or private by data subjects, even if this is not specifically mentioned in Art. 9 GDPR. GDPR or Art. 10 GDPR are listed. Example: Financial, location or family data.
Reasonable expectations of the data subjects (Recital 47, paragraph 1 of the GDPR)
Where and when is the data collected?
An indication in favor of the data subject exists if the data is used for a completely new, unrecognizable purpose or a purpose that goes beyond the original purpose and the data subject could not reasonably have expected the data processing at the time of collection (see also Art. 6 para. 4 GDPR).
How is the data collected?
What technologies and methods are used? Are these practices generally known and transparent for the persons concerned? Examples: Online surveys, Competitions, Web scraping.
How is data processing made transparent to the data subjects?
The Duty to inform according to Art. 13 and 14 GDPR must be observed. This information must be provided directly when the data is collected. Otherwise, the lawfulness of the Processing already due to the missing Transparency.
Is there a relationship with the persons concerned?
If a relationship already exists between the data subject and the controller, this increases the foreseeability of data processing, Recital 47 p.2 to the GDPR. Example: The affected Person is already a customer.
How extensive is the data collection and how many people are affected?
The greater the scope of data processing, the higher the risk that the rights of the data subjects will be infringed.
What are the potential negative effects of data processing on data subjects?
If a Data Protection Impact Assessment or has a threshold analysis been performed?
Are there any positive effects of processing on data subjects?
If the Processing in the objective, presumed interest of the data subject. Examples: Time savings, financial benefits.
Do the individuals concerned lose control over how their personal data is used?
Are there any protective measures in place to minimize the impact? If necessary, can the affected individuals take protective measures themselves?
Who processes the data? How many people have access?
What are the qualifications of the persons or companies processing the data? Is the data treated confidentially? Are there access restrictions within the meaning of Art. 32 para. 4 GDPR?
Examples of Balancing Interests
Direct advertising to existing customers:
A company would like to use customer data to send postal Advertising for similar products. Interest: effective marketing (legitimate economic interest, Recital 47). Data: Name and address. Normal data has already been collected as part of the customer relationship. NecessityDispatch impossible without this data; milder means would possibly be. Consent, However, in the case of direct advertising to existing customers, the law grants the company a legitimate interest. Consideration: Due to the business relationship, customers have a certain expectation of receiving occasional Advertising and the intervention is limited to moderate letter advertising. In addition, an opt-out option is clearly offered. Result: As a rule, the interests of the company prevail here, the Processing is permissible.
Video Surveillance of a Retail Store:
A store owner installs surveillance cameras in the sales area to prevent theft. Purpose: Protection of property, safety of employees and customers (legitimate interest). Data: Video recordings of everyone in the store (potentially many Affected parties, partly sensitive behavioral data; possibly also employees = special protection needs according to BVerfG case law in employment relationships). Necessity: Could alternatives such as hiring more staff or using anti-theft tags be sufficient? If not, is Video Surveillance Generally appropriate as a last resort. Considerations: This must be carefully examined: The measure infringes upon the right to Privacy of customers. Mitigation through Transparency (signs), limited camera angles (no surveillance of private areas such as toilets) and short storage periods are important. If the store is located in a high theft area and surveillance takes place during opening hours, the operator's interest (protection against significant damage) could just about outweigh the customer's interest in not being observed while shopping. Provided that no less intrusive solution is available. However, if continuous filming were to take place without notice, or if areas were monitored that Privacy enjoy (e.g., changing clothes), the Rights of data subjects clearly predominate and the Processing would be inadmissible. The expectations of the employees are also relevant under labor law: Covert surveillance would be disproportionate, open camera with works council approval possibly permissible if no permanent stress/surveillance pressure arises. Courts (including the Federal Constitutional Court) demand strict proportionality and respect for employee rights.
Legitimate interest as legal basis
These examples make it clear that balancing interests requires a case-by-case assessment. Minor changes in the facts (different scope of data, different context) can alter the outcome. Therefore, the balancing must be carried out specifically and documented for each processing activity. If the rights of the data subjects are significantly impaired, the limit of what is permissible has been reached. In that case, the Rights of data subjects and Art. 6 para. 1 lit. f GDPR does not provide a basis for legitimacy.
Conversely, if the three-step test is carefully carried out and documented, Art. 6 para. 1 lit. f GDPR provide a reliable legal basis in many situations.
Source: Questionnaire on the Balancing of Interests Under the GDPR by the HmbBfDI
Implement processing intelligently with Ailance
You wish to carry out the three-step verification in accordance with Art. 6 para. 1 lit. f GDPR not only correctly, but also verifiably and scalably. Including clean Documentation, review workflow and regular re-evaluation? Ailance helps you to optimize processes for Transparency, Contradiction (Art. 21 GDPR) and Deletion (Art. 17 GDPR) efficiently.
Arrange a demo of Ailance and find out how you can legitimate interests Document everything in an audit-proof manner and ensure your data protection—Compliance strengthen sustainably.
Aristotelis Zervos is Editorial Director at 2B Advice, a lawyer and journalist with profound expertise in data protection, GDPR, IT-Compliance and AI governance. He regularly publishes in-depth articles on AI regulation, GDPR-Compliance and risk management. You can learn more about him on his Author profile page.
German 
English 
Italian 
French