What is the 'legitimate interests' basis? | ICO

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. What does the UK GDPR say about the legitimate interests lawful basis? “You must have a lawful basis to process personal information in line with the ‘lawfulness, fairness and transparency’ principle.” Article 6(1)(f) of the UK GDPR says:

   In Legitimate interest assessment

2. 1. Processing shall be lawful only if and to the extent that at least one of the following applies: “(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” Legitimate interests is different to the other lawful bases because it:

   In Legitimate interest assessment

3. show that it’s legitimate in the specific circumstances. “In particular, you mustensure your direct marketing complies with the Privacy and Electronic Communication Regulations 2003 (PECR) rules on consent.” The UK GDPR’s examples of legitimate interests aren’t exhaustive. You may also be able to demonstrate in a wide range of other situations that you’re using personal information for the purposes of legitimate interests.

   In National ePrivacy implementation