Legitimate interest assessment

A legitimate interest assessment is the go/no-go record for a cold email campaign. Write it before processing begins.¹ The campaign then needs to pass the purpose, necessity, and impact tests. A LIA is a documented campaign-level justification explaining why outreach is relevant, proportionate, and respectful of the recipient's rights.² Scope is part of the reasoning: decide who will receive the messages, what they will say, which data they will use, and which safeguards will apply.

Set the legal frame

Identify the legal basis you are testing and its limits. The LIA supports a decision about this processing activity. Check the rules that govern the email itself as well.

Legitimate interests is one of the seven lawful bases for handling personal information.³ You need a lawful basis to process personal information in line with lawfulness, fairness and transparency.⁴ Under UK GDPR, the legitimate interests provision is in Article 6(1)(f).⁵ It covers processing necessary for the legitimate interests pursued by the controller or a third party, unless the person's interests or fundamental rights and freedoms override them. Children receive particular protection under this provision.⁶

Write the basis in plain language at the top of the assessment. State which campaign it covers, who will receive the messages, what information you will use, and what the message will say.

State the business interest

Give the campaign a purpose that can be tested. Keep it close to the proposed outreach so the assessment does not become a general approval for future activity.

An LIA is a self-assessment tool for identifying the impact of processing, avoiding risks from unfair processing, and checking lawfulness.⁷ It is also a fairness test when legitimate interests is the legal basis for processing personal data.⁸ The assessment addresses three main questions about the processing activity.⁹

Write answers to these questions:

• What business interest is the campaign pursuing?
• Which audience does that interest concern?
• Why does this offer belong in that audience's professional context?
• Which personal data will you use to select and contact people?
• What result would make the campaign worth running?

Avoid a purpose such as "grow the pipeline" on its own. Say what the outreach concerns and why this audience is connected to it. Another rep should be able to read the purpose and tell which contacts fit without guessing.

Test necessity

Use the necessity test to remove data and scope that the purpose cannot defend. Inspect the proposed processing field by field, then narrow the campaign until each part has a job.

Ask: "Is processing this personal data actually necessary to achieve it?"¹⁰ The requested data should stay within what is needed for the stated business purpose.¹¹

For each field, record what it enables. Ask whether the purpose can be reached with less personal data, a narrower audience, or a shorter retention period. Check the contact route and whether each piece of information changes the selection, message, or follow-up. If a field has no clear use, remove it or record why it remains.

A useful necessity conclusion explains why this data supports this campaign and what the team will leave out. If it only repeats the business interest, the test is unfinished.

Balance the impact

Give the recipient a clear place in the balance test. Record the benefit the campaign seeks and the effect the outreach may have on the people receiving it.

An LIA records consideration of the impact on data subjects and tests whether the organisation's interests are outweighed by the impact on their data protection rights and interests.¹² Marketing commonly serves the business's interests, so assess the possible consequences for the individual carefully.¹³

Use these questions to work through the impact:

• Would the recipient understand why this message relates to their work?
• What could make the contact unexpected or intrusive?
• Does the data source change how the recipient may view the message?
• How easily can the recipient stop further outreach?
• What restriction would reduce the impact without defeating the purpose?

Each contact should be genuinely relevant to the offering because relevance supports the legitimate interests assessment.¹⁴ Record why the contact is relevant and which safeguards address the risks you identify. Conclude with a clear decision for this campaign. If the impact outweighs the business interest, narrow the audience, change the processing, or stop the campaign.

Turn the decision into send rules

A signed assessment helps only when the rep can follow it during execution. Convert the conclusion into checks for the list, the message, and responses from recipients.

Match the length of the LIA to the complexity or sensitivity of the processing activity.¹⁵ Keep the campaign purpose, data source, fields used, relevance reasoning, balancing conclusion, and safeguards together. An audit document that records privacy policy details and the conduct of the LIA can provide a demonstrable record of lawfulness.¹⁶

Create a process for objections and data requests before launch. Decide where opt-outs will be recorded, how future messages will be stopped, who handles questions about the data, and when the data is removed. If the assessment remains difficult to defend after those controls are written down, ask a lawyer to check the outbound strategy.¹⁷

What not to do

These mistakes can turn a defensible assessment into a permission slip. Keep them visible when the campaign is approved and when the list is handed to the rep.

• Do not treat legitimate interests as automatic permission for every cold email.¹⁸
• Do not leave national ePrivacy rules, transparency, necessity, balancing, or the right to object outside the review.¹⁹
• Do not send a message that is irrelevant to the person's role, hide where the data came from, or omit a clear opt-out from every email.²⁰
• Do not ignore a person's request for information or keep the data when the required process says to purge it.²¹
• Do not rely on a blanket annual sign-off. Legitimate interest requires a fresh documented assessment for each campaign or purpose.²²

Use the completed assessment as a release gate. If the purpose, necessity case, or balance conclusion cannot be written clearly, hold the campaign. Once the send rules are recorded, the rep can explain the outreach, respect an objection, and show why each part of the processing belongs in that campaign.