Legitimate Interest Assessment Builder
Work through the purpose, necessity and balancing tests for relying on legitimate interests, with a scored balancing outcome and a copyable assessment record.
Last reviewed by the Radiatus Cloud team
Going for ISO 27001, SOC 2, HIPAA or GDPR?
Radiatus runs end-to-end compliance & GRC programs.
Legitimate interests is the hardest basis to use and the easiest to claim
Article 6(1)(f) is available where processing is necessary for a legitimate interest that is not overridden by the interests or fundamental rights of the individual. All three limbs must hold, and the third is a genuine balancing exercise whose outcome can go either way. The basis is popular because it requires no consent, and it is misused for exactly that reason: an organisation that would find consent inconvenient does not thereby acquire a legitimate interest.
Necessity is a real constraint, not a formality
Necessary does not mean useful or commercially preferable. If the purpose can be achieved with less data, or without personal data at all, or by a means the individual would find less intrusive, the processing is not necessary in the sense Article 6 uses. This limb defeats more assessments than the balancing test does, and it is the one most often skipped because it feels like a restatement of the purpose.
Reasonable expectations decide most balancing tests
Recital 47 makes the individual's reasonable expectations central: whether, at the time the data was collected and in the context of the relationship, the person could reasonably expect processing of this kind. Data collected for one purpose and later used for an unrelated one usually fails here, and no amount of transparency after the fact repairs it. The presence of children, of special category data, or of a decision with legal effects will normally tip the balance on its own.
Related tools
- SOC 2 Evidence Readiness — Interactive checklist to gauge your SOC 2 evidence readiness.
- Privacy Policy Checker — Check if your policy covers standard requirements (GDPR/CCPA basics).
- Compliance Req Finder — Find which standards (ISO, SOC2, HIPAA) apply to your industry/region.
- Audit Readiness Planner — Plan your compliance audit timeline (SOC2, ISO) backwards from deadline.
Frequently Asked Questions
When can I not use legitimate interests?
Public authorities cannot use it for processing in the performance of their tasks. It is also unavailable in practice where a decision produces legal effects, where children are the focus, or where special category data is involved without an Article 9 condition.
What does "necessary" mean here?
That the purpose cannot reasonably be achieved with less data, without personal data, or by a less intrusive means. It does not mean useful or commercially preferable, and this limb defeats more assessments than the balancing test does.
Does an opt-out fix a failing balance?
It helps but does not rescue a purpose the individual would not reasonably expect. A right to object exists regardless under Article 21, so offering it is not a concession that shifts the balance far.
Do I have to write the assessment down?
Accountability under Article 5(2) means you must be able to demonstrate the basis, which in practice requires a record made before the processing starts rather than reconstructed afterwards.
Is a score the answer?
No. The score here shows which factors are pulling in which direction and how strongly. The conclusion is a judgement, and where the score is close the honest answer is usually that another basis is needed.
Privacy & Security
Everything runs in your browser; nothing is uploaded.
How to Use
Answer the three-part test to produce a legitimate interest assessment.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
SOC 2 Evidence Readiness
ComplianceInteractive checklist to gauge your SOC 2 evidence readiness.
Privacy Policy Checker
ComplianceCheck if your policy covers standard requirements (GDPR/CCPA basics).
Compliance Req Finder
ComplianceFind which standards (ISO, SOC2, HIPAA) apply to your industry/region.