What is Legitimate Interest Assessment?
A Legitimate Interest Assessment (LIA) is a short, documented test organisations use under data protection law (for example GDPR) to decide whether they can lawfully process personal data without consent because their legitimate purpose does not override individuals’ rights.
An LIA is a practical three-part check used to justify certain kinds of personal data processing. It asks: (1) Purpose — what legitimate interest are we pursuing? (2) Necessity — is the processing necessary to achieve that interest (is there a less intrusive way)? (3) Balancing — do the individual’s privacy rights outweigh the organisation’s interest? The output is a written record explaining the decision, the risks identified and the safeguards put in place (data minimisation, retention limits, opt-outs, anonymisation, etc.). LIAs are commonly used for operational activities (e.g., service improvement, fraud prevention, internal communications) but are not a substitute for consent where consent is the appropriate basis, nor are they normally appropriate for sensitive (special category) data.
Usage example
A council wants to send a short multilingual survey invitation to residents to improve local services. They run an LIA: Purpose — improve services through resident feedback; Necessity — contact details and answers are needed to invite people and analyse responses; Balancing — low intrusion because the email is optional, the survey can be completed anonymously, retention is limited to six months, and an easy opt‑out is provided. The council documents these findings and the safeguards before sending the invitation.
Practical application
Doing an LIA matters because it: (1) helps you choose a lawful basis for processing and avoid regulatory problems; (2) forces you to consider and reduce privacy risks (e.g., by minimising data, adding opt-outs or anonymising responses); (3) produces a record you can show stakeholders or auditors to demonstrate you considered people’s rights; and (4) builds trust with communities by showing thoughtful, proportionate handling of their data. For teams running multilingual surveys (schools, councils, charities), an LIA clarifies whether you can invite or follow up participants without collecting explicit consent every time, and what safeguards you must apply when you do.
FAQ
When should we use an LIA instead of asking for consent?
Use an LIA when you have a clear legitimate interest (for example, improving a public service) and the processing is necessary and proportionate. Consent is preferable when people must have a free choice (e.g., marketing or when there is a power imbalance) or when you need a clear, specific agreement to process data. If in doubt, document your reasoning — and if people can reasonably refuse or withdraw, consent may be safer.
Do we always have to complete an LIA?
No — you only need an LIA if you intend to rely on legitimate interest as your lawful basis. If you rely on consent, contract, legal obligation or another lawful basis, an LIA isn’t required. However, doing a short LIA is good practice whenever the lawful basis is not obvious, because it records your decision and the mitigations you put in place.
Can we use a Legitimate Interest Assessment for sensitive (special category) data?
Generally no. Special category data (health, race, religion, etc.) requires additional legal conditions beyond legitimate interest, so an LIA alone is usually not sufficient. Treat such data as high risk: consider whether you should avoid collecting it, obtain explicit consent, or carry out a Data Protection Impact Assessment (DPIA).
What if the balancing test fails — can we still proceed?
If the balancing test shows individuals’ rights outweigh your interest, you should not rely on legitimate interest. Options then include redesigning the processing to reduce impact (e.g., anonymise responses, reduce retention), seeking explicit consent, or abandoning that processing activity.