What is the recognised legitimate interest basis?

At a glance

• Recognised legitimate interest is one of the lawful bases for handling personal information. It is separate from the legitimate interests lawful basis. 
• It has five conditions containing pre-approved purposes that are in the public interest.
• For these purposes, you don’t have to assess whether a person’s rights, freedoms or interests outweigh the recognised legitimate interest.
• You don’t have to change lawful basis if you currently use legitimate interests for a purpose that is a recognised legitimate interest. 

In detail

• What does the UK GDPR say about recognised legitimate interest?
• What counts as a recognised legitimate interest?
• What are the benefits of using recognised legitimate interest?
• What’s the difference between recognised legitimate interest and the legitimate interests basis?
• What does necessary mean?

What does the UK GDPR say about recognised legitimate interest?

Recognised legitimate interest is one of the seven lawful bases for handling personal information. It was added to the UK GDPR by the Data (Use and Access) Act 2025 (DUAA). You must have a lawful basis to use personal information in line with the ‘lawfulness, fairness and transparency’ principle. No single basis is ‘better’ or more important than the others – which basis is most appropriate to use depends on your purpose and relationship with the people involved.

Article 6(1)(ea) says:

"1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(ea) processing is necessary for the purposes of a recognised legitimate interest;”

The UK GDPR adds that:

“5. For the purposes of paragraph 1(ea), processing is necessary for the purposes of a recognised legitimate interest only if it meets a condition in Annex 1.”

A ‘recognised legitimate interest’ is a specified purpose for handling personal information that is in the public interest. These pre-approved purposes are the recognised legitimate interest conditions.

What counts as a recognised legitimate interest?

Annex 1 of the UK GDPR lists the pre-approved purposes. They cover situations where you need to use personal information to:

• share it with another organisation that has requested it from you because they need it for their public task or official functions (the ‘public task disclosure request condition’);
• safeguard national security, protect public security or for defence reasons (the ‘national security, public security and defence condition’); 
• respond to, or deal with, an emergency situation (the ‘emergencies condition’);
• prevent, detect or investigate crimes, including the apprehension and prosecution of offenders (the ‘crime condition’); or
• protect the physical, mental or emotional well-being of people who need extra support to do this or protect them from harm or neglect (the ‘safeguarding condition’). 

The Secretary of State can make changes to the recognised legitimate interest conditions, subject to Parliamentary approval. This includes adding new conditions (we will update this guidance if the conditions change). 

What are the benefits of using recognised legitimate interest?

The aim of the recognised legitimate interest lawful basis is to give you greater confidence when you handle personal information for one of its pre-approved purposes.

Data protection law says these purposes are activities in the public interest. Any potential impact on people is therefore justified – subject to other data protection considerations as normal.

As a result, the main benefit of relying on recognised legitimate interest is you don’t need to do anything else to justify using personal information for one of these purposes. You don’t need to balance people’s rights and freedoms against the relevant interests you have identified because the law has already done so.

However, this doesn’t mean you can use personal information without any restrictions. You must satisfy yourself that using the information is necessary for the particular recognised legitimate interest condition. You must also comply with all the other requirements of the law. 

What’s the difference between recognised legitimate interest and legitimate interests?

Recognised legitimate interest and legitimate interests are two separate lawful bases. It’s your choice which basis to rely on, so long as you can meet its requirements. The UK GDPR enables you to handle personal information where this is necessary for the public interest.

Below is a summary of the main differences and similarities between them: 

(For more information about the right to object, see What else do we need to consider?. For information on automated decisions, see Can we use recognised legitimate interest for automated decision-making?.) 

Using legitimate interests as a lawful basis is more flexible, as it’s not limited to a specific set of conditions. But you must do a three-part test where you consider:

• your purpose;
• what’s necessary to achieve that purpose; and
• balance these against people’s rights, interests and freedoms.

All five of the recognised legitimate interest conditions are interests that are likely to meet the purpose test under the legitimate interests lawful basis, depending on the circumstances. This means you could choose legitimate interests as your lawful basis instead. But if you do, you must apply the three-part test in full.

If your reason for handling personal information meets the criteria for one of its five conditions, you can have confidence that recognised legitimate interest is a suitable lawful basis without the need to do the same three-part test. But you must assess necessity.

If you’re currently using legitimate interests as your lawful basis for a purpose that meets a recognised legitimate interest condition, you don’t have to change lawful basis. 

What does necessary mean?

For each of the recognised legitimate interest conditions, you must demonstrate it is necessary for you to use personal information. This doesn’t mean it has to be absolutely essential, but you must ensure it is a targeted and proportionate way of achieving the pre-approved purpose. 

You should decide this based on:

• the facts of each case; and
• whether there is another reasonable and less intrusive alternative available. Using the more invasive way is not necessary if you can achieve your purpose in a less invasive way. 

If you can’t show what you want to do actually helps meet the recognised legitimate interest condition, you won’t be able to use this lawful basis. You must assess if a different lawful basis applies.