Definition
A legitimate interest assessment is a three-part test that organisations must complete and document to rely on legitimate interest as their legal basis for sending marketing emails. It is most commonly used for B2B email marketing where consent is impractical.
The Three-Part Test
- Purpose test: What is the legitimate interest? (e.g., promoting relevant business services to professionals in your sector)
- Necessity test: Is the processing necessary? Could you achieve the same result with less intrusive means?
- Balancing test: Does the individual's rights and interests override your legitimate interest?
Why It Matters
Without a documented LIA, you cannot legally rely on legitimate interest as a basis for sending. If a B2B recipient complains to their data protection authority, you must be able to produce your LIA as evidence. Regular review and updates are recommended as business practices evolve.
Related Glossary Terms
CAN-SPAM Act
The CAN-SPAM Act is a US law that sets rules for commercial email. It requires accurate subject lines, a physical address, a clear opt-out mechanism, and prompt processing of unsubscribes. Violations can result in penalties up to $51,744 per email.
Consent Expiry (Email Marketing)
Consent expiry is the time period after which a subscriber's permission to send marketing emails legally expires and must be re-obtained, varying by jurisdiction and consent type.
Right to Data Portability (GDPR)
The right to data portability allows individuals to obtain and reuse their personal data across different services, including exporting subscriber data from email marketing platforms.
Data Processing Agreement (DPA)
A Data Processing Agreement (DPA) is a legally binding contract between a data controller and a data processor that defines how personal data will be handled, required under GDPR for email service providers.
Data Retention Schedule (Email Marketing)
A data retention schedule defines how long subscriber personal data is stored after unsubscribing or becoming inactive, ensuring compliance with GDPR, CCPA, and similar privacy laws.
Data Subject Access Request (DSAR)
A Data Subject Access Request (DSAR) is a GDPR right allowing individuals to request access to their personal data held by an organisation, including email marketing data.