Lawfulness and transparency

Perform a legitimate interests assessment

Document the purpose, the necessity and the balancing test where legitimate interests are relied upon, and require approval before the activity becomes active.

A retailer wanting to run fraud analytics on transaction data cannot rely on legitimate interests as a slogan. The purpose has to be stated, the necessity of the processing has to be tested against a less intrusive alternative, and the balance against the individual's interests has to be written down and approved.

This use case is exercised as its own document, held apart from the activity but linked to it, so the assessment can be reused, revised and re-approved without touching the activity record itself.

The proof is that the activity is held back from going live until this specific document carries an approval, and that the resulting notice states the interest pursued in terms an individual could understand.

Regulation

Article 6(1)(f)

Registers

Document · Processing activity · Risk · Privacy notice

The steps

1. 01Open the Documents register and use the plus button beside the register title to create a document of the legitimate interests assessment type.
2. 02Complete the purpose section in the dialog that opens.
3. 03Complete the necessity section, stating the less intrusive alternatives considered.
4. 04Complete the balancing section, weighing the interest against the impact on the individual.
5. 05Open the Linked records band and use "Link a record" to attach the processing activity it supports.
6. 06Move the document from Draft to Approved on the lifecycle bar, naming the approver.
7. 07Return to the activity and confirm the assessment now appears on its Evidence tab.

Accepted when

• The activity cannot reach In use while the assessment is unapproved.
• The notice states the interest pursued.