Definition
Legitimate interest is one of the six lawful bases for processing personal data under the UK GDPR and EU GDPR. It allows organisations to process personal data without explicit consent when the processing is necessary for a legitimate purpose (such as marketing, fraud prevention, or network security) and the individuals rights and interests do not override that purpose.
For email marketing, legitimate interest is most commonly used for B2B prospecting, existing customer marketing within reasonable expectations, and soft opt-in scenarios.
Legitimate Interest vs Consent
| Factor | Legitimate Interest | Consent |
|---|---|---|
| Requirement | Genuine legitimate purpose, balancing test | Freely given, specific, informed, unambiguous |
| Opt-in required | No — opt-out provided | Yes — active opt-in required |
| Best for | B2B marketing, existing customer relations | B2C marketing, sensitive data, high-privacy contexts |
| Documentation | Legitimate Interest Assessment (LIA) | Consent records |
| Withdrawal | Objection must be honoured | Consent can be withdrawn at any time |
The Three-Part Legitimate Interest Test
| Step | Question | Documentation |
|---|---|---|
| 1. Purpose test | What is the legitimate interest? | Identify the specific purpose (marketing, security, analytics) |
| 2. Necessity test | Is the processing necessary for that purpose? | Demonstrate that the same outcome cannot be achieved with less intrusive means |
| 3. Balancing test | Do the individuals rights override the legitimate interest? | Assess impact on privacy, expectations, and potential harm |
When to Use Legitimate Interest for Email
- B2B marketing to professional contacts: Business email addresses at organisations where the contact has a professional interest in your offering.
- Existing customer marketing (soft opt-in): Marketing similar products or services to existing customers who provided their email in a prior transaction.
- Service notifications: Important updates about products or services the subscriber already uses.
- Personalised recommendations: Product suggestions based on purchase history, where the subscriber would reasonably expect this.
Documentation Requirements
Using legitimate interest requires:
- A documented Legitimate Interest Assessment (LIA)
- Clear privacy notice explaining the legitimate interest basis
- Easy opt-out mechanism in every marketing communication
- Process for handling objections without delay
Was this useful?
Related Glossary Terms
A/B Testing
A/B testing in email marketing is the practice of sending two variations of an email to a small sample of your list to determine which version performs better before sending the winner to the remaining subscribers.
Abandoned Cart Email
An abandoned cart email is an automated message sent to customers who added items to their online shopping cart but left without completing the purchase. It is one of the highest-converting email types in ecommerce.
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
AI Email Summary
An AI email summary is a short, machine-generated overview of an email's key points, shown by Gmail, Outlook and Apple Mail before a recipient opens the message. It is reshaping how email marketers think about subject lines, preview text and open rates.
AI Inbox Summary
An AI inbox summary is an AI-generated digest that condenses unread email — often highlighting news, actions and senders — changing how clearly your marketing email reaches and engages subscribers.
AI Inbox
An AI inbox is an email client that uses artificial intelligence to summarise, sort, prioritise and sometimes answer emails before the human recipient reads them. It is transforming email marketing metrics and copywriting.
Frequently Asked Questions
No. Legitimate interest is not suitable for all contexts. It is generally appropriate for B2B marketing, existing customer relationships, and service-related communications. It is less appropriate for B2C cold email, sensitive data processing, or contexts where subscribers would not reasonably expect marketing.
A Legitimate Interest Assessment is a documented analysis that demonstrates your organisation has identified a genuine legitimate interest, the processing is necessary, and the individuals rights do not override that interest. The ICO provides a template for conducting LIAs.
Yes. Every marketing email sent under legitimate interest must include a clear, functioning unsubscribe mechanism. The right to object to processing under legitimate interest is a fundamental GDPR right.
Not retrospectively. If you collected data under consent, you cannot change the lawful basis to legitimate interest without informing the data subject. You can prospectively change the basis for future processing but must communicate this change.
Soft opt-in is a specific application of legitimate interest for ecommerce and similar businesses marketing their own similar products to existing customers. Legitimate interest is the broader lawful basis. Soft opt-in is one scenario where legitimate interest may apply.