Legitimate interests is one of the lawful bases for using personal data under UK GDPR. It allows a business to use someone’s data without asking for consent, where the use is genuinely needed for a reasonable purpose and does not override that person’s own interests, rights and freedoms.
How legitimate interests works
You cannot simply declare that you have a legitimate interest. UK GDPR expects you to work through a three-part test, and in practice to write it down as a legitimate interests assessment (LIA).
- Purpose test. Is there a real, specific interest? Telling existing customers about a related service, preventing fraud on a booking form or analysing which product lines sell are all genuine business interests.
- Necessity test. Is the processing actually needed for that purpose, or could you achieve it with less data or in a less intrusive way?
- Balancing test. Weigh your interest against the person’s. Would they reasonably expect this use? Could it cause harm or distress? Are any of them vulnerable, such as children?
The LIA records the answers, the date and who made the decision. It is usually a page or two, and the ICO publishes a template you can follow.
The Data (Use and Access) Act 2025 made two changes. It states in the body of the law that direct marketing can be a legitimate interest, which had previously appeared only in the explanatory recitals. It also created a separate basis, recognised legitimate interests, for a short list of purposes such as crime prevention and safeguarding, where no balancing test is needed. Commercial marketing is not on that list. At the time of writing (October 2026), both changes are in force.
Why it matters
Legitimate interests is the basis much marketing relies on when consent is not the right fit: postal mailings to existing customers, analysing your own customer data and some business-to-business outreach. That flexibility is exactly why it gets misused.
The biggest trap is electronic marketing. UK GDPR decides whether you have a lawful basis to use the data, but PECR separately decides whether you may send a marketing email or text at all. For individuals, including sole traders and some partnerships, PECR generally requires consent unless the soft opt-in applies: you collected their details during a sale or negotiation, you are marketing your own similar products, and you offered an opt-out at the time and in every message since. An LIA cannot override PECR. Emails to staff at limited companies do not need consent under PECR, so legitimate interests is commonly used there, with an opt-out in each message.
The same separation applies to cookies. PECR, not legitimate interests, decides whether a non-essential cookie needs consent.
Common mistakes
- Choosing legitimate interests because consent feels inconvenient, then never writing an assessment.
- Relying on it for marketing emails or texts to individuals who have not consented and do not qualify for the soft opt-in.
- Uploading a customer list to an ad platform as a Customer Match audience without considering whether customers would expect it, or telling them in the privacy notice.
- Forgetting that people have an absolute right to object to direct marketing; once someone objects, you must stop.
- Not naming the specific interest in the privacy notice, which UK GDPR requires.
How to act on it
List every marketing activity that uses personal data: newsletters, retargeting audiences, CRM analysis, postal mailings and sales follow-up. For each, decide the lawful basis and, where it is legitimate interests, complete a short LIA. Then answer the PECR question separately for anything sent by email or text, or stored by a cookie.
Make objecting easy: an unsubscribe link in every piece of email marketing, a suppression list synced to every tool, and a clear route explained in your privacy notice. Revisit the assessments when you add a new channel or data source.
When I set up performance marketing that uses customer lists or audience data, the lawful basis and the PECR position for each list are agreed before anything is uploaded.