Legitimate interest

A lawful basis under Article 6(1)(f) of the GDPR, allowing a company to process ordinary personal data if its legitimate interests outweigh the interests and rights of the data subject. The basis requires a documented balancing exercise — a legitimate interests assessment — and the processing must be necessary for the purpose. Typical examples are direct marketing to existing customers, IT security and internal administration. The data subject always has the right to object to processing based on legitimate interest.