Lawful Basis and Legitimate Interest

What is a lawful basis?

Under the GDPR, every use of personal data needs a legal reason, called a lawful basis (regulators also say legal basis). Article 6(1) says processing "shall be lawful only if and to the extent that at least one of the following applies", and lists six:

• Consent: the person agreed to the use for one or more specific purposes.
• Contract: the use is necessary to perform a contract with the person, or to take steps they asked for before signing one.
• Legal obligation: the use is necessary to comply with a law the controller is subject to.
• Vital interests: the use is necessary to protect the vital interests of the person or of someone else.
• Public task: the use is necessary for a task in the public interest or for official authority.
• Legitimate interests: the use is necessary for the legitimate interests of the controller or a third party, unless the person's interests or rights override them.

The basis is chosen by the controller, the company that decides why the data is used, and it is chosen per purpose. The same customer record can be used under contract to deliver the service, under legal obligation to keep invoices, and under legitimate interests to prevent fraud.

You must say which basis you use. Article 13(1)(c) requires your privacy notice to state the purposes and the legal basis, and Article 13(1)(d) requires it to name the legitimate interests pursued when that basis is used. The basis also decides some rights. Consent can be withdrawn at any time under Article 7(3), and it must be as easy to withdraw as to give. Legitimate interests give the person a right to object under Article 21.

What is legitimate interest?

Legitimate interest is the most flexible basis. Article 6(1)(f) allows processing that is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party", except where those interests "are overridden by the interests or fundamental rights and freedoms of the data subject", in particular where the person is a child. Public authorities cannot rely on it for their tasks.

The EDPB's guidelines on legitimate interest (version 1.0, adopted in October 2024 for public consultation and, as of October 2026, still the only version published) say three conditions must all be met:

1. A legitimate interest: only interests that are lawful, precisely articulated and present count. A commercial interest can qualify. The EDPB cites a judgment of the EU Court of Justice of 4 October 2024, in a case about the Royal Dutch Lawn Tennis Association (C-621/22), that a commercial interest can be a legitimate interest provided it is not contrary to the law, assessed case by case.
2. Necessity: the interest cannot reasonably be achieved just as effectively by other means that intrude less on people's rights.
3. Balancing: the person's interests, rights and freedoms do not take precedence. This turns on the impact on the person, their reasonable expectations and the safeguards in place.

The EDPB says this assessment should be documented, and done before the processing starts. It also warns that legitimate interest is not a last resort, and should not be chosen just because it seems less demanding than the other bases.

The GDPR's Recital 47 gives examples where it can apply: processing strictly necessary to prevent fraud, and direct marketing. Even then, under Article 21(2) a person can object to direct marketing at any time, and the use must stop. Other laws can also rule it out: the EDPB notes that the ePrivacy Directive generally requires prior consent for marketing emails and texts.

The balancing test has real limits. In a July 2023 judgment in a case between Meta and Germany's competition authority (C-252/21), the Court held that the personalized advertising that funds Facebook could not justify, as a legitimate interest, processing users' data without their consent.

Recent changes in the UK and the EU

In the UK, the Data (Use and Access) Act 2025 added "recognised legitimate interests", such as public security, for which the ICO says you no longer need to balance the impact on the people concerned. Those provisions have been in force since 5 February 2026. The ICO says the Act also makes clear that direct marketing can be a legitimate interest, and that all its data protection provisions are now in force. See UK GDPR.

In the EU, the Digital Omnibus proposal of November 2025 would add an Article 88c saying that the development and operation of AI systems and models may rely on legitimate interests, with safeguards such as an unconditional right to object. In their February 2026 joint opinion, the EDPB and the EDPS said this is already possible under the current GDPR and that the three-step test still applies. The Council's negotiating position of October 2026 keeps a version of it, but as of October 2026 the European Parliament has not voted and nothing has been adopted, so Article 6 applies as it stands.

What it looks like in a vendor's terms

A vendor's privacy policy may list each of its own purposes with its basis. A typical passage reads:

We process personal data on the basis of our legitimate interests to operate, secure and improve our services, to develop new features, including features that use machine learning, to understand how customers use our products, and to market our services. Where we rely on legitimate interests, you may object to the processing at any time by contacting us.

• "Our legitimate interests": the vendor is using the data for itself, as a controller, not only for you as a processor.
• "Improve our services" and "develop new features": broad purposes that can cover a lot. See the "improve our services" clause.
• "Machine learning": a sign the data may feed model training. Read it next to the vendor's AI terms.
• "You may object": the Article 21 right. Outside direct marketing, the vendor may keep processing if it shows compelling legitimate grounds that override the person's interests.

Why it matters to you

When a vendor works for you as a processor, it acts on your instructions, and the lawful basis is yours to choose and document. Under Article 28(10), a processor that starts deciding its own purposes and means is treated as a controller for that processing. The EDPB's guidelines on controllers and processors say the same.

That is why a vendor's legitimate interest passage matters. If it uses your users' data for its own purposes, such as product analytics or AI training, it acts as a controller for that use. Your DPA may not cover it, and your own privacy notice may need to mention it, since Article 13(1)(e) asks you to name the recipients, or categories of recipients, of people's data.

It can also affect your own basis. If you rely on legitimate interest to share data with a vendor, a change in what the vendor does with it can change the balance, because people's reasonable expectations are part of the test.

What to check

• Role: whether the vendor's DPA calls it a processor for your data, and whether its privacy policy claims any uses of that data for itself.
• Basis per purpose: which basis the vendor names for each of its own uses, especially analytics, product improvement and AI.
• Opt-outs: whether you can turn off the vendor's own uses, such as an AI training opt-out.
• Your own records: that your privacy notice and your records of processing activities name a basis for each use, including data you send to vendors.
• Legitimate interest assessments: that you have a written assessment for each use based on legitimate interest, done before the use started.
• New purposes: when a vendor adds a purpose under legitimate interest, whether your notice and your assessment still hold.

How Venpo helps

A vendor's basis for using your data appears in its privacy policy, DPA or AI terms, and new purposes arrive through edits to those documents. Venpo watches your vendors' public legal documents and emails you a plain-English alert when a vendor adds a purpose, changes a basis or claims a new use of your data. The Fine Print Scan also answers, per vendor, whether AI is trained on your data and whether the vendor can sell or share it.