What is the recognised legitimate interest basis?

In detail

• What does the UK GDPR say about recognised legitimate interest?
• What counts as a recognised legitimate interest?
• What are the benefits of using recognised legitimate interest?
• What’s the difference between recognised legitimate interest and legitimate interests?
• What does necessary mean?

What does the UK GDPR say about recognised legitimate interest?

Recognised legitimate interest is one of the seven lawful bases for handling personal information. It was added to the UK GDPR by the Data (Use and Access) Act 2025 (DUAA). You must have a lawful basis to use personal information in line with the ‘lawfulness, fairness and transparency’ principle. No single basis is ‘better’ or more important than the others – which basis is most appropriate to use depends on your purpose and relationship with the people involved.

Article 6(1)(ea) says:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(ea) processing is necessary for the purposes of a recognised legitimate interest;

The UK GDPR adds that:

5. For the purposes of paragraph 1(ea), processing is necessary for the purposes of a recognised legitimate interest only if it meets a condition in Annex 1.

A ‘recognised legitimate interest’ is a specified purpose for handling personal information that is in the public interest. These pre-approved purposes are the recognised legitimate interest conditions.

What counts as a recognised legitimate interest?

Annex 1 of the UK GDPR lists the pre-approved purposes. They cover situations where you need to use personal information to:

• share it with another organisation that has requested it from you because they need it for their public task or official functions (the ‘public task disclosure response condition’);
• safeguard national security, protect public security or for defence reasons (the ‘national security, public security and defence condition’);
• respond to, or deal with, an emergency situation (the ‘emergencies condition’);
• prevent, detect or investigate crimes, including the apprehension and prosecution of offenders (the ‘crime condition’); or
• protect the physical, mental or emotional well-being of people who need extra support to do this or protect them from harm or neglect (the ‘safeguarding condition’).

The Secretary of State can make changes to the recognised legitimate interest conditions, subject to Parliamentary approval. This includes adding new conditions (we will update this guidance if the conditions change).

What are the benefits of using recognised legitimate interest?

The aim of the recognised legitimate interest lawful basis is to give you greater confidence when you handle personal information for one of its pre-approved purposes.

Data protection law says these purposes are activities in the public interest. Any potential impact on people is therefore justified – subject to other data protection considerations as normal.

As a result, the main benefit of relying on recognised legitimate interest is you don’t need to balance people’s rights and freedoms against the relevant interests you’ve identified because the law has already done so.

However, this doesn’t mean you can use personal information without any restrictions. You must satisfy yourself that using the information is necessary for the particular recognised legitimate interest condition. You must also comply with all the other requirements of the law.

What’s the difference between recognised legitimate interest and legitimate interests?

Recognised legitimate interest and legitimate interests are two different lawful bases. It’s your choice which basis to rely on, so long as you can meet its requirements.

If you’re currently using legitimate interests as your lawful basis for a purpose that meets a recognised legitimate interest condition, you don’t have to change your lawful basis. But you could choose to rely on recognised legitimate interest as your lawful basis when handling personal information for a pre-approved purpose in future.

Below is a summary of the main differences and similarities between these two lawful bases.

(For more information about the right to object, see What else do we need to consider?.)

Using legitimate interests as a lawful basis is more flexible, as it’s not limited to a specific set of conditions. But you must do a three-part test where you consider:

• your purpose;
• what’s necessary to achieve that purpose; and
• balance these against people’s rights, interests and freedoms.

We refer to where you assess and document the three part-test as a ‘legitimate interests assessment’ (LIA).

There’s no three-part test for the recognised legitimate interest basis which means you don’t need an LIA. However, to rely on recognised legitimate interest, you must:

• ensure your purpose meets the criteria for one of its conditions; and
• assess if what you want to do with the personal information is necessary for that purpose.

Recognised legitimate interest presumes that your interests and those of the person whose information you want to use are balanced. Therefore, there’s no requirement for you to do a balancing test of the type required by the legitimate interests basis. However, you must still be accountable and you should record why recognised legitimate interest applies.

All the purposes covered by the five recognised legitimate interest conditions are also likely to meet the purpose test under the legitimate interests lawful basis, depending on the circumstances. This means you could choose legitimate interests as your lawful basis and apply the three part-test instead of using recognised legitimate interest.

What does necessary mean?

For each of the recognised legitimate interest conditions, you must demonstrate it is necessary for you to use personal information. This doesn’t mean it has to be absolutely essential, but you must ensure it is a targeted and proportionate way of achieving the pre-approved purpose.

You should decide this based on:

• the facts of each case; and
• whether there is another reasonable and less intrusive alternative available. Using the more invasive way is not necessary if you can achieve your purpose in a less invasive way.

If you can’t show what you want to do actually helps meet the recognised legitimate interest condition, you won’t be able to use this lawful basis. You must assess if a different lawful basis applies.