Legitimate interests assessment: the three-part test, written down

The rule: Article 6(1)(f) and the three-part test

Legitimate interests is a lawful basis under Article 6 of the UK GDPR. Point (f) of Article 6(1) allows processing that “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” The paragraph ends by saying that points (ea) and (f) “shall not apply to processing carried out by public authorities in the performance of their tasks.”

The three parts of the test come from those words: a legitimate interest, processing that is necessary for it, and a balance the person's interests do not override. The ICO's guidance How do we apply legitimate interests in practice? names them:

1. “The purpose test (identify the legitimate interest).”
2. “The necessity test (consider if your use of the personal information is necessary).”
3. “The balancing test (consider the person’s interests).”

The same page draws the line between the test and the document: “To demonstrate that legitimate interests applies, you must do the three-part test. You should document the outcome. We refer to documenting the outcome as a ‘legitimate interests assessment’ or LIA (although the UK GDPR doesn’t use this terminology).” And on writing it down: “You should record your LIA and the outcome. There’s no specific requirement in the UK GDPR for you to do this. However, you must ensure that you’re accountable. This means that you should keep an audit trail of your decisions and justification for relying on legitimate interests.”

That accountability duty is Article 5(2) of the UK GDPR: the controller “shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).” The ICO's A guide to lawful basis adds that “you must keep a record of which basis you’re relying on for each purpose and a justification for why you believe it applies”, and that “if you’re relying on legitimate interests, you must have more detail in your privacy information”. Article 13(1)(d) requires the privacy notice to state, where processing is based on point (f), “the legitimate interests pursued by the controller or by a third party”; Article 14(2)(b) is the equivalent where the information did not come from the person.

The ICO describes an LIA as “a type of light-touch risk assessment. It is based on the specific context and circumstances of what you want to do with the personal information.” It adds that “There’s no standardised approach to an LIA. Sometimes your LIA might be quite short, but in other situations, it may be much more detailed.” The timing is fixed: “You should do your LIA before you start using the personal information.” The regulator has been the Information Commission since 30 September 2026; it is still known as the ICO.

Who can rely on legitimate interests, and who cannot

Legitimate interests is open to organisations that are not public authorities, and to public authorities only for processing outside their tasks. Recital 47 of the UK GDPR, in the recitals to the Regulation, gives the reason: “Given that it is for the legislator to provide by law for the legal basis for public authorities to process personal data, that legal basis should not apply to the processing by public authorities in the performance of their tasks.”

• Organisations that can use it: charities, independent schools, private nurseries and childminders, and private care providers, for purposes where another basis does not fit better, such as a supporter mailing, CCTV in shared areas, network security, staff emergency contacts or handling a staff grievance.
• Public authorities, for their tasks: under section 7 of the Data Protection Act 2018, a public authority under the Freedom of Information Act 2000 is a public authority for the UK GDPR only “when performing a task carried out in the public interest or in the exercise of official authority vested in it”. Schedule 1 to the Freedom of Information Act 2000 lists the governing bodies of maintained schools and maintained nursery schools (paragraph 52), the proprietor of an academy “in respect of information held for the purposes of the proprietor's functions under Academy arrangements” (paragraph 52A) and, in Northern Ireland, the managers of controlled, voluntary and grant-maintained integrated schools and pupil referral units (paragraph 54). Their teaching, safeguarding and other statutory work rests on another basis, usually public task.
• Public authorities, outside their tasks: the bar applies only “in the performance of their tasks”, so a state school or academy trust may still rely on legitimate interests for something that is not part of its public work. The Department for Education's Data (Use and Access) Act 2025 compliance checklist for schools tells schools in England to “continue to complete legitimate interests assessments where standard legitimate interests are used”.

Choosing between the bases for each purpose is the subject of lawful basis for processing. This guide starts where that choice has landed on legitimate interests, and covers how to show the choice holds.

The three-part test, step by step

The ICO says “There’s no defined process for an LIA”, but “you must address each part of the three-part test. You should record the outcome, including all the relevant factors, whether or not they support your conclusion.” Each part below gives the question the law asks and the ICO's prompts for answering it.

1. The purpose test. The ICO says you must identify your purpose and “decide whether it counts as a legitimate interest”, and to “Be as specific as possible, as this helps you with the necessity and balancing tests.” Its prompts include “Why do you want to use the personal information?”, “What benefit do you expect to get from that use?”, “Do any third parties benefit from the processing?” and “What would the impact be if you couldn’t go ahead?” Since 5 February 2026, Article 6(11) of the UK GDPR says that “examples of types of processing that may be processing that is necessary for the purposes of a legitimate interest include”:

• “processing that is necessary for the purposes of direct marketing”,
• “intra-group transmission of personal data (whether relating to clients, employees or other individuals) where that is necessary for internal administrative purposes”, and
• “processing that is necessary for the purposes of ensuring the security of network and information systems.”

Recital 47 adds that processing “strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest”. Being on a list settles only the first part. The ICO says the list “only gives you a possible answer to the purpose test. You must not assume that the purpose is sufficient to rely on legitimate interests.” It also says to check whether the purpose falls within the separate recognised legitimate interest basis, covered in section 05: “You may find that basis more appropriate.”

2. The necessity test. “You must consider carefully whether your use of the personal information is actually necessary for the purpose you identify in step one.” The ICO's prompts are whether the processing will actually help, “Is what you want to do proportionate to achieve that purpose, or is it excessive?”, “Can you achieve your purpose without using the personal information, or by using less information?” and “Can you achieve your purpose by using the information in another, more obvious or less intrusive way?” Record the alternatives you rejected and why: “If there are potentially other less intrusive alternatives, you should be clear why these aren’t reasonable alternatives.”

3. The balancing test. “You must consider the interests and fundamental rights and freedoms of the person and whether these override the legitimate interests you have identified.” The ICO says “There’s no exhaustive list of what to consider when conducting the balancing test, but you must include people’s reasonable expectations”, and that you should also think about the nature of the information, the likely impact and the safeguards you can put in place. Recital 47 ties expectations to the relationship, “taking into consideration the reasonable expectations of data subjects based on their relationship with the controller”. The ICO calls it “an objective test”: “you should show that a reasonable person would expect the processing in the particular circumstances.”

• Children. Article 6(1)(f) names them, and the ICO says “If you want to use children’s information, you must consider what the child might reasonably expect you to do with their information, in the context of your relationship with them. You must make sure that you adequately protect their interests.”
• Sensitive information. Special category data, criminal offence data and information about people at risk of harm weigh heavily: “The more sensitive or ‘private’ the information, the more likely that its use will be intrusive.”
• Safeguards. The ICO's examples are to “collect less personal information; or provide people with an opt-out”. An opt-out does not turn the basis into consent: “Failure to opt out doesn’t demonstrate consent.”

The outcome. Weigh the factors for and against and decide. The ICO says “The more significant the risks, the more compelling the justification you should have”, and where the answer is unclear, “If you’re not sure, it may be safer to look for another lawful basis. Legitimate interests is not often the most appropriate lawful basis for handling personal information in a way that is unexpected or high risk.” Then keep it current: “you should review the LIA regularly”, and “Refresh your LIA as appropriate (eg if anything significant changes, such as your purpose, nature or context).”

A legitimate interests assessment template, and four worked examples

The ICO publishes a Sample LIA template (Word) and says “The LIA doesn’t have to take any particular form, although you could use our sample LIA template, if you find it helpful.” The one-page structure below follows the three parts; it is ours, not the ICO's, and the headings are the ones a complaint or an ICO enquiry is likely to ask about.

Four examples show how the parts land in the sectors this guide covers. The first, third and fourth are illustrations, not rulings; the second is the ICO's own.

• A charity writing to its supporters. Purpose: raising funds for its charitable purposes; direct marketing is an Article 6(11) example, and Recital 47 says processing for direct marketing “may be regarded as carried out for a legitimate interest”. Necessity: writing to people who have given before, using the details they gave. Balancing: a recent donor would reasonably expect an appeal, and a clear opt-out is a safeguard, as in the ICO's example of a retailer posting offers, whose customers “are likely to reasonably expect that they may receive some marketing material”. Email and text are governed separately: regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 “applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers”, and requires their consent unless a soft opt-in applies. Since 5 February 2026 that includes the charity soft opt-in in regulation 22(3A), which among other conditions requires that “the sole purpose of the direct marketing is to further one or more of the charity’s charitable purposes”, and the ICO's guidance on electronic mail marketing says “You must only use it if you obtained the recipient’s contact details on or after this date.” An LIA does not replace that consent. Charity communication policy covers the email rules.
• Emergency contacts for staff. The ICO's own example: an employer collecting the details of each employee's nominated family member or friend, where consent from all of them is not practical. The purpose is being able to reach someone in an emergency, there is “no other reasonable way of achieving the purpose”, the information is not sensitive, and the safeguards are that “only their HR department will have access to these contact details” and the details are used only in an emergency. The ICO concludes “the balance favours their legitimate interest”. The same reasoning fits a care provider or a charity with staff and volunteers.
• CCTV in the shared areas of a private care home. Purpose: the safety of residents and staff. Necessity: which areas, which hours and whether sound is needed. Balancing: residents live there, footage can show personal care and health, and many residents are at risk of harm, so the expectations and the impact weigh heavily, and footage that shows health is special category data, which needs a condition under Article 9 of the UK GDPR as well as a lawful basis; an LIA does not supply one. The ICO says that where you identify a potential high risk, “you must have a more compelling legitimate interest to satisfy the balancing test” and it “also triggers the need to do a DPIA”. Where the purpose is only detecting or preventing crime, check the crime condition in Annex 1 first. CCTV in care homes covers the law and CQC's expectations.
• Network security at an independent school. Purpose: ensuring the security of network and information systems, an Article 6(11) example; Recital 49 says processing “to the extent strictly necessary and proportionate for the purposes of ensuring network and information security ... constitutes a legitimate interest of the data controller concerned.” Necessity: the logs needed to detect and stop an attack, kept for a set period, not more. Balancing: most users are pupils, so the test weighs the interests of a child in particular; the privacy notices for pupils, parents and staff say what is kept and why. A maintained school or academy doing the same work for its public task would rely on public task instead.

When an LIA is not the whole answer: recognised legitimate interest, objections and DPIAs

Recognised legitimate interest. Since 5 February 2026, Article 6(1)(ea) of the UK GDPR allows processing that “is necessary for the purposes of a recognised legitimate interest”, and Article 6(5) says processing is necessary for one “only if it meets a condition in Annex 1”. Annex 1 to the UK GDPR has five conditions:

• Disclosure for purposes of processing described in Article 6(1)(e)
• National security, public security and defence
• Emergencies
• Crime
• Safeguarding vulnerable individuals

The safeguarding condition, for example, “is met where the processing is necessary for the purposes of safeguarding a vulnerable individual.” The ICO's summary of the Data (Use and Access) Act 2025 changes explains the difference from legitimate interests: “There is still a necessity test, but there is no requirement for an organisation to carry out an additional balancing test” of the benefits against the impact on people's rights. A record is still expected. On the safeguarding condition, the ICO says “you should document your assessment of how the adult meets the criteria to be ‘at risk’ of vulnerability, including any evidence that supports your decision”, and where the condition is not met, “the legitimate interests lawful basis may be appropriate. But you must satisfy its three-part test”. An independent school, charity or care provider can use recognised legitimate interest only for an Annex 1 purpose; anything else needs the full test. The DfE's checklist notes that “Public authorities cannot rely on recognised legitimate interests to carry out their statutory functions.”

The right to object. Article 21(1) of the UK GDPR gives people the right to object to processing based on point (e), (ea) or (f), after which “The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.” The LIA is where those grounds are first written down. For direct marketing the right is absolute under Article 21(3): “Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.”

A DPIA. An LIA is not a data protection impact assessment. Article 35(1) of the UK GDPR requires a DPIA, “prior to the processing”, where processing “is likely to result in a high risk to the rights and freedoms of natural persons”, whatever the lawful basis. The ICO says “If your LIA identifies potential high risks to people’s rights and freedoms, you must do a DPIA to assess the risks and potential safeguards in more detail”, and that the two need not be duplicated: “If you’ve not yet carried out an LIA, there’s no need to do both. You could use your DPIA instead of an LIA to demonstrate how legitimate interests applies, as it covers the same information in more detail.” DPIA for schools covers when one is required.

Consent withdrawn. Legitimate interests is not a fallback. The ICO's guide to lawful basis says you can’t usually swap from consent to a different basis, and in its worked example on the point, “Even if the company might have originally relied on legitimate interests, they cannot do so at a later date.” Choose the basis before you start, and record why.

Where ComplyChat fits, and where it does not

Start with what it is not. ComplyChat does not write, check or store your legitimate interests assessment, and it is not a fundraising database, a CCTV system or a network security tool. It is not end-to-end encrypted, by design: the organisation has to be able to hold the record. ComplyChat is working towards Cyber Essentials and ISO 27001 certification and holds neither yet.

Where an LIA meets messaging is the staff matter. The ICO's own example of a clear outcome is an employer sending details of an employee's alleged misconduct to its legal advisers, where the information “concerns the employee’s professional life rather than their private life” and there is “a clearly defined employer-employee relationship”. An employer outside the public sector that reads work messages during a grievance or a disciplinary relies on the same reasoning, and its balancing test turns on what staff were told, because the test must include people's reasonable expectations. Monitoring staff communications covers what an employer may check and what staff should be told.

That reasoning only works for messages the organisation holds. A staff group on personal phones is not a system the employer runs, so an LIA can say nothing accurate about what is kept, for how long, or who can read it. ComplyChat is designed to give the assessment something true to describe: channels the organisation runs, where everyone added is told the channel is on the record and can object or leave at any time, and messages recorded on the server as they are sent rather than gathered from handsets afterwards. A mobile number verified by SMS is the identity, so bank and agency staff and volunteers without a work account sit under the same assessment. On paid plans, once the organisation's tenant is connected, conversations are kept under the retention schedules within its own Microsoft 365 subscription. ComplyChat replaces the WhatsApp group; it does not capture or archive WhatsApp.

Free is for personal conversations: one private group channel, direct messages, up to 25 people and three calendar months of recent history, with no Microsoft 365 archive, so it cannot be the system an organisation's assessment describes as the record.

A question for the next leadership or board meeting: if we were asked tomorrow for the legitimate interests assessment behind reading staff work messages, what would it say about the group chat on everyone's phones?

Questions people ask

What is the 3 part test for legitimate interest?

The three-part test is the purpose test (is there a legitimate interest?), the necessity test (is the processing necessary for it?) and the balancing test (do the person's interests, rights and freedoms override it?). The ICO says you must do it to rely on legitimate interests, and each part comes from the words of Article 6(1)(f) of the UK GDPR, which weighs the interests of a child “in particular”.

Is a legitimate interests assessment a legal requirement?

No: the ICO says “The UK GDPR doesn’t require you to do an LIA. But you should do one anyway.” The three-part test itself is required, and the accountability principle in Article 5(2) means you must be able to show you applied it, which is what the LIA records.

What are examples of legitimate interests?

Article 6(11) of the UK GDPR, in force since 5 February 2026, gives three examples of processing that may be necessary for a legitimate interest: direct marketing, intra-group transmission for internal administrative purposes, and ensuring the security of network and information systems. Recital 47 adds processing strictly necessary to prevent fraud. A listed purpose still has to pass the necessity and balancing tests.

Is a PIA legally required?

Under the UK GDPR the assessment is a data protection impact assessment (DPIA), and Article 35(1) requires one before processing that “is likely to result in a high risk to the rights and freedoms of natural persons”. An LIA is a lighter record; if its balancing test finds a potential high risk, the ICO says you must do a DPIA as well, or use the DPIA in place of the LIA.

What are the grounds for legitimate interest under GDPR?

Article 6(1)(f) of the UK GDPR makes processing lawful where it “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party”, unless the person's interests or fundamental rights and freedoms override them, in particular where the person is a child. It does not apply to public authorities, such as maintained schools and academy trusts, for processing in the performance of their tasks.

Legitimate interest or consent: which should we use?

The ICO suggests legitimate interests if “you wish to keep control and take responsibility for demonstrating that it is in line with people’s reasonable expectations”, and consent if you prefer to give people “full control over and responsibility for their information (including the ability to change their mind as to whether you can continue using it)”. Decide before you start: you can’t usually swap from consent to another basis later, and marketing emails and texts to individuals still need consent or a soft opt-in under PECR, whichever basis you choose.

Official guidance and your next step

The law is in Article 6, Article 21, Article 35 and Annex 1 of the UK GDPR, with section 7 of the Data Protection Act 2018 for who counts as a public authority and regulation 22 of PECR for marketing by email and text. The regulator's guidance is How do we apply legitimate interests in practice?, with its sample LIA template, and A guide to lawful basis. Schools in England also have the DfE's DUAA compliance checklist for schools. EU guidance on legitimate interests does not set UK law. Quotations from the ICO's legitimate interests page are as read on 9 November 2026, and from its lawful basis and recognised legitimate interest pages as saved on 8 November 2026.

This guide covers the UK and is not legal advice. Which basis fits each purpose, and the other six bases, are in lawful basis for processing; what a privacy notice must say about legitimate interests is in charity privacy notice and employee privacy notice.

Then do one thing: list every line in your privacy notices and record of processing that says “legitimate interests”, and next to each, write where its assessment is. A line with nothing next to it is your first LIA.