Legitimate interests: the three-part test, explained
Most business data processing doesn't rely on consent at all; it relies on legitimate interests, and that has to pass a three-part test you should write down.
The legitimate interests assessmentICO guidance on legitimate interests
Applied to licensing records
Purpose: raising revenue from records the company already holds.
Necessity: only the records and fields actually needed.
Balancing: de-identification, exclusions and opt-outs tip it in favour.
Write it down
A documented legitimate interests assessment, alongside a DPIA for higher-risk processing, is what a regulator will ask to see.
Key takeaways
Three tests: purpose, necessity, balancing.
Safeguards strengthen the balance.
Document it before processing starts.
Sources
ICO: Legitimate interests guidance
What could your company's records earn?
A free, nine-question estimate. No files, no logins.
