Legitimate interest is the most flexible of the GDPR's lawful bases for processing personal data. Theoretically, it applies whenever an organisation uses personal data in a way that the data subject would expect.

When can you rely on legitimate interest?

You can rely on legitimate interests for marketing activities if you can show that how you use people's data is proportionate, has a minimal privacy impact, and people would not be surprised or likely to object – but only if you don't need consent under PECR.

What is the lawful basis of legitimate interest mostly used?

Legitimate interests is most appropriate as a lawful basis where companies use personal data in a way that individuals can reasonably expect. If it impacts individuals, it can still apply if the controller company can justify there is a compelling reason for the impact the processing will have.