DAILY

Legitimate interests assessment

Available Data protection

Art. 6(1)(f) GDPR allows processing when three conditions are met cumulatively: a legitimate interest, the necessity of the processing for it, and a balancing test showing that the interests, fundamental rights and freedoms of the data subjects do not override it. The assessment follows EDPB Guidelines 1/2024. The result is a reasoned estimate you must document and stand behind.

Applicability

1. Does a public authority process the data in the performance of its tasks?

Then Art. 6(1)(f) is excluded; points (c) or (e) with a legal basis in Union or national law come into question.

Art. 6 Abs. 1 UAbs. 2 DSGVO Open in the law texts

Step 1: Legitimate interest

2. Is the interest pursued lawful, i.e. compatible with Union and national law?
EDPB Leitlinien 1/2024, Abschnitt 2.2.1
3. Is the interest clearly and precisely articulated?
EDPB Leitlinien 1/2024, Abschnitt 2.2.1
4. Is the interest real and present, not speculative?
EDPB Leitlinien 1/2024, Abschnitt 2.2.1

Step 2: Necessity

5. Is the processing suitable to actually achieve the interest?
EDPB Leitlinien 1/2024, Abschnitt 2.3
6. Is there no equally effective but less intrusive means to achieve the interest?

"Yes" means: there is no less intrusive alternative.

EDPB Leitlinien 1/2024, Abschnitt 2.3
7. Is the processing limited to the data and persons necessary for it?
Art. 5 Abs. 1 lit. c DSGVO Open in the law texts

Step 3: Balancing

The first questions describe circumstances that weigh against the processing, the last ones circumstances that weigh in its favour.

8. Are special categories of personal data (Art. 9) or data on criminal offences (Art. 10) processed?
Art. 9, 10 DSGVO Open in the law texts
9. Are children affected?

Art. 6(1)(f) singles out children expressly; their protection carries great weight.

Art. 6 Abs. 1 lit. f, ErwG 38 DSGVO Open in the law texts
10. Is data processed on a large scale, combined with other data or used for profiling?
EDPB Leitlinien 1/2024, Abschnitt 2.4
11. Could the data subjects face significant consequences such as discrimination, financial loss, reputational damage or loss of control over their data?
EDPB Leitlinien 1/2024, Abschnitt 2.4
12. Can the data subjects reasonably expect this processing at the time and in the context of the collection?
ErwG 47 DSGVO Open in the law texts
13. Is there a relevant and appropriate relationship with the data subjects, for example because they are customers?
ErwG 47 DSGVO Open in the law texts
14. Are there additional safeguards such as pseudonymisation, short retention, restricted access or extra transparency?
EDPB Leitlinien 1/2024, Abschnitt 2.4.5
15. Are data subjects informed about their right to object, and can they exercise it easily?
Art. 21 DSGVO Open in the law texts
This result is not saved. With an account, assessments are stored with date and catalog version.
Menu
Preview · What this means
Dark paper