Legitimate Interest Assessment (LIA)

Evaluates whether the processing is strictly necessary to achieve the stated purpose. This is not a 'nice-to-have' assessment; it requires proving the objective cannot be reasonably achieved through less intrusive means.

• Is there an alternative? If anonymized data works, pseudonymized data is excessive.
• Proportionality: The volume of data collected must be the minimum required.
• Function Creep: Data collected for security cannot be repurposed for marketing under the same LIA.

Weighs the controller's legitimate interests against the rights and freedoms of the data subject. This is the core risk assessment where the controller must consider the reasonable expectations of the individual.

• Power Imbalance: Processing employee data requires a higher bar than customer data.
• Vulnerable Subjects: Children's data demands heightened protection.
• Surprise Factor: If the processing would be unexpected, the balance tips toward the individual.

If the individual's rights override the controller's interest, consent becomes the only valid legal basis.

Documents the compensating controls that mitigate residual risk to the data subject. These technical and organizational measures make the intrusion acceptable.

• Technical: Immediate pseudonymization, data-at-rest encryption, strict access controls.
• Procedural: An absolute right to opt-out that is presented clearly and actioned instantly.
• Transparency: A prominent, specific privacy notice explaining the balancing logic.

Without robust safeguards, the balancing test will fail.

Records the final decision and the mechanism for the right to object. Under GDPR Article 21, the data subject has an absolute right to object to direct marketing processing, and a conditional right for other interests.

• Documentation: The LIA must be a written record retained for accountability.
• Compelling Grounds: If the controller rejects an objection, they must demonstrate 'compelling legitimate grounds' that override the individual's interests.
• Dynamic Review: The LIA is a living document that must be revisited if the context or technology changes.

Technical and organizational measures that enforce data minimization and prevent repurposing of data. An LIA's validity is tied to a specific, declared purpose. If data is later used for a different purpose, a new LIA is required. Purpose limitation controls include access restrictions, data segregation, and automated policy enforcement that prevent processing outside the scope defined in the original assessment.

A centralized software solution that captures and manages user consent preferences. When an LIA concludes that legitimate interests is the appropriate lawful basis, the CMP must still present this clearly in the consent banner or preference center. The CMP distinguishes between processing based on consent (requiring an opt-in) and processing based on legitimate interests (requiring an opt-out mechanism), ensuring transparency under the IAB Transparency and Consent Framework (TCF).

A privacy design pattern allowing users to provide separate, specific opt-in choices for distinct processing purposes. When legitimate interests is used alongside consent for different processing operations, the controller must ensure clear separation between these legal bases. Bundling consent-dependent processing with legitimate-interest processing into a single agreement undermines the freely given standard and may invalidate the consent entirely.