What is Legitimate Interests (UK GDPR)?

Legitimate interests is one of the six lawful bases for processing personal data under Article 6 of the UK GDPR. To rely on it, the organisation must carry out a three-part Legitimate Interests Assessment (LIA): identify a legitimate interest (commercial, social or legal), show the processing is necessary for that purpose, and demonstrate the interest is not overridden by the rights and freedoms of data subjects — the so-called balance test. It cannot be used for processing special category data (health, biometric, race, religion) which requires a separate condition under Article 9. The LIA should be documented and included or referenced in the privacy notice.