Legitimate interests is a test, not a label
Legitimate interests requires a three-part assessment: a real interest, processing that is necessary for it, and a balance that does not override the data subject's rights — judged against what they would reasonably expect.
Why it is like this
It is the only open-ended basis, so it comes with its own homework. The balancing test is what stops "we have an interest" from swallowing the regulation.
Not to be confused with
A catch-all for processing you cannot otherwise justify. It is also unavailable to public authorities acting in their tasks, and it carries an unconditional right to object for direct marketing.
In practice
Fraud detection usually passes: necessary, expected, limited. Selling the same data to a broker usually fails at the balancing step, however real the commercial interest.
Source: Regulation (EU) 2016/679 (GDPR) — Article 6(1)(f) and Recital 47. Read on .
Say it back Check yourself
Name the three parts of a legitimate interests assessment, and the one thing the third part is measured against.
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- A legitimate interest exists (yours or a third party's)
- The processing is necessary for it — no less intrusive route
- A balancing test against the data subject's rights and freedoms
- Measured against the data subject's reasonable expectations
People remember "balancing" and forget necessity, which is where most assessments actually fail: the interest is real but the processing is wider than it needs to be.