What is “balancing test” for legitimate interest?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Before you can rely on legitimate interest as your GDPR lawful basis, you need to complete a three-part assessment. The balancing test is the third part, and it's the one most likely to determine whether you can actually use this basis.
The three parts of a Legitimate Interest Assessment (LIA):
1. Purpose test: What's your legitimate interest? It needs to be real and specific, not vague. "Marketing" isn't enough. "Following up with companies that downloaded our whitepaper on X topic" is more like it.
2. Necessity test: Is processing personal data actually necessary to achieve that purpose? Could you do it another way that doesn't require the data? If yes, you can't use legitimate interest.
3. Balancing test: Do your interests outweigh the individual's privacy rights and reasonable expectations? This is where you weigh what you gain against what the person loses or risks. Factors include: how sensitive the data is, whether they'd reasonably expect this kind of contact, whether you have a prior relationship, and what the potential impact on them is if you're wrong.
If the person would be surprised or disturbed to know you're processing their data this way, that's a signal the balancing test doesn't pass.
Document all three steps. A Legitimate Interest Assessment should be a real document with your reasoning, not a checkbox. Regulators who investigate complaints will ask to see it. Check your lawful basis documentation for how this fits into the broader records requirement, and see the consent vs legitimate interest comparison if you're still deciding which basis to use.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
