Law · 7 November 2026 · 6 minute read
Legitimate interest under the GDPR: the 3 steps of the test
Art. 6(1)(f) GDPR explained: the three-step test, examples from marketing and sales, documentation and the right to object under Art. 21.
Legitimate interest is the legal basis that many companies rely on in marketing and sales. It seems convenient because no banner and no signature are needed. But it is also the basis that takes the most work of your own: you have to assess it yourself, balance it yourself and be able to prove the result. This article explains the rule, the three steps of the test and the typical stumbling blocks.
What the rule says
Art. 6(1)(f) GDPR permits the processing of personal data if it is „necessary for the purposes of the legitimate interests pursued by the controller or by a third party“. This applies only unless those interests are overridden by the interests or fundamental rights of the data subject that require protection of their data. Public authorities cannot rely on it in the performance of their tasks. You will find the wording in the GDPR on EUR-Lex.
The basis is one of six of equal rank. It has no priority over consent and is not a safety net when consent is missing. Where the law requires consent for a process, point (f) cannot replace it. This applies above all to access to the end device, more on this in Consent or legitimate interest: how to decide.
The three steps of the test
The Court of Justice of the European Union examines the rule in three stages, all of which must be met. It formulated this in this way, among others, in the judgment of 4 October 2024 (CJEU, C-621/22, Koninklijke Nederlandse Lawn Tennisbond).
| Stage | Question | Typical mistake |
|---|---|---|
| 1. Interest | Are you pursuing a legitimate interest? | Interest merely asserted in general terms („marketing“) |
| 2. Necessity | Is the processing necessary for it? | More data than needed, although less would do |
| 3. Balancing | Do the data subjects' interests not override? | Data subjects' expectations not considered |
Stage 1: the interest. It must be lawful, clearly stated and actually present. In the judgment mentioned, the CJEU clarified that an economic interest too can be a legitimate interest, as long as it does not violate the law. Recital 47 expressly names direct marketing as a possible legitimate interest.
Stage 2: necessity. Here you ask whether there is a less intrusive means. If you can achieve a goal with less data, you must take less data. If the company is enough for you, you do not need a person. This is the principle of data minimisation from Art. 5(1)(c) GDPR.
Stage 3: balancing. You weigh your interest against the interests of the data subjects. According to Recital 47, the benchmark is the reasonable expectations of the data subjects based on their relationship with you. Anyone who is a customer expects a newsletter about similar products. Anyone who has visited a page only once does not expect a dossier. The more sensitive the data and the deeper the intrusion, the more likely the balancing is to go against you.
Examples from marketing and sales
The following cases show the range. Whether they hold up in an individual case depends on the circumstances. The classification is not a guarantee.
- Postal advertising to existing customers. Often regarded as defensible because customers expect it. Competition law must also fit.
- Fraud prevention and IT security. Recital 47 names the prevention of fraud as a legitimate interest. Companies often base logs for defending against attacks on it.
- Company assignment on the website. Anyone who only looks up the network owner of an IP address processes little and has a clear goal. Whether an IP address is personal data in a specific case is explained in IP address and GDPR: is it personal data?.
- Profiles of individuals from purchased data. Here the balancing becomes difficult, because data subjects do not expect it.
For approaching someone after a website visit, competition law is added to the GDPR. What applies there in each country is covered in Cold outreach in B2B: what is allowed in Germany, Austria and Switzerland.
Documentation: the burden of proof is on you
Under Art. 5(2) GDPR you must be able to demonstrate compliance with the principles. For point (f), in practice that means:
- State the interest in one sentence.
- Record why it cannot be done with less data.
- Write down the balancing with the most important arguments, with the date and the person responsible.
- Include the processing in your record under Art. 30 GDPR, where it is mandatory.
- Name the legitimate interest in the privacy policy. Art. 13(1)(d) GDPR requires the interests to be stated for this basis.
- Review the balancing again if purpose, data or technology change.
Objection under Art. 21
Anyone relying on point (f) must grant a right to object. There are two cases (Art. 21 GDPR):
- General objection (paragraph 1). The person can object on grounds relating to their particular situation. You must then stop the processing, unless you demonstrate compelling legitimate grounds that override.
- Objection to direct marketing (paragraphs 2 and 3). No reason is needed here. After an objection, the data may no longer be processed for advertising.
Under paragraph 4, you must expressly draw attention to this right at the latest at the first communication, clearly and separately from other information.
Frequently asked questions
With legitimate interest, do I not need to inform the data subjects? You do. The information obligations under Art. 13 and 14 GDPR apply in this case too. With this basis, you must also state the legitimate interests.
Is legitimate interest enough for cookies and tracking scripts? For access to the end device, usually not. There, § 25 TDDDG applies in Germany and § 165(3) TKG 2021 in Austria, and both in principle require consent. The GDPR basis only concerns the subsequent processing. More on this in § 25 TDDDG: cookies and tracking in Germany.
Do I have to record the balancing in writing? The GDPR does not prescribe a fixed form. Because of the duty of proof in Art. 5(2), however, written documentation is the safe route.
