Legitimate interest is one of the legal basis and is stated in Art. 6 (f) GDPR. This legal basis can be used when the data controller can conclude that the processing is necessary for their legitimate interest and this interest can outbalance the data subjects interests and rights as data subjects.

The analysis must be documented in a legitimate interest assessment (LIA) and the main points shall be included in the relevant information notices to the affected data subjects.

An example of an area where legitimate interest most often are used to motivate the processing is when the personal data are being processed for certain marketing purposes, internal security and fraud prevention, administration of staff etc.

It is worth to note that public authorities can not use legitimate interest for processing that is carried out in the performance of their tasks.