Can Businesses Rely on Legitimate Interests?

Yes, in most cases businesses can rely on legitimate interests, and the ICO describes it as the most flexible of the seven lawful bases for handling personal information under UK GDPR. It can apply to a wide range of business activities, from staff training to fraud prevention, but it is not automatic. 

To rely on “legitimate interests”, you need to satisfy what is known as the three-part test, covering purpose, necessity, and balancing. This means identifying a genuine business reason for the processing, showing that using the personal data is genuinely necessary to achieve it rather than just convenient, and then weighing your interests against the rights and expectations of the individual concerned.

The balancing element is where most organisations need to take the most care. As the ICO's guidance explains, an individual's interests are likely to override yours if they would not reasonably expect you to use their information in that way, or if doing so would cause them unjustified harm. This is a contextual judgement rather than a fixed rule, so it is worth documenting your reasoning through a legitimate interests assessment, even though this is not strictly mandatory under the law. Keeping a record helps demonstrate accountability if your decision is ever questioned by an individual or the regulator.

It is also worth knowing that since 5th February 2026, UK GDPR has included a separate basis called recognised legitimate interest, introduced by the Data (Use and Access) Act 2025. This applies to five specific public interest purposes, such as safeguarding and emergencies, and does not require the balancing test. However, this new basis is distinct from general legitimate interests and is not available under EU GDPR, so businesses operating across both the UK and EU need to keep their compliance approach for each jurisdiction separate. If your situation does not fall within one of the five recognised categories, the standard three-part test still applies, and getting that assessment right remains the responsible approach.