EDPB Finalises Its Legitimate Interest Guidelines: A Practical LIA Walkthrough

Europe’s data protection authorities have finished their rewrite of the most argued-over legal basis in the GDPR. On November 10, 2026, the European Data Protection Board adopted version 2.0 of Guidelines 1/2024 on processing based on Article 6(1)(f), the legitimate interest ground, two years after a first draft went out for consultation. The final text keeps the three-step test that controllers already know. What it adds is sharper language on what makes an interest “legitimate,” a new idea of an interest’s “weight,” clearer rules on mitigating measures and a one-page flowchart that turns the whole test into a decision path. If your organisation relies on legitimate interest for analytics, fraud checks, security logging, B2B outreach or intra-group sharing, this is a good moment to reopen your assessments.

What the Board adopted, and what changed since 2024

The first version of the guidelines was adopted on October 8, 2024, and was open for comments until November 20, 2024. According to the EDPB’s report on the public consultation, it drew 80 contributions, most of them from business associations and companies. Many respondents said the draft was too restrictive. The Board’s answer is polite but firm: it believes most of those objections came from misreadings of the GDPR or of the guidelines, so they did not lead to major changes. It did, however, add clarifications in many places, and some of them matter in practice.

The headline changes are these:

• “Present and effective” is clarified. An interest must be lawful, clearly articulated, and present and effective rather than speculative. The final text explains that an interest qualifies if it matches current activities or activities already planned for the near future.
• Interests now have weight. A new paragraph says legitimate interests range from trivial to significant. A trivial interest can only justify processing whose impact on people is insignificant. An interest that coincides with a wider public interest, such as fraud prevention, can carry more weight.
• Positive effects count. The balancing test should consider every way people may be affected, including benefits to them, and not only the risks.
• Mitigating measures are defined more tightly. The baseline for the balancing test is the impact that remains once you already comply with the GDPR, including data minimisation and privacy by design. Only measures that go beyond the law can shift a failing balance, and you must be able to show how they changed the result.
• Transparency on request. As a best practice, the Board says people should be told they can obtain information about the balancing test from the controller.
• AI and newer case law. The final version points to the Board’s December 2024 opinion on AI models and cites Court of Justice judgments handed down after the draft, including Mousse (C-394/23), Inteligo Media (C-654/23) and NTH Haustechnik (C-484/24).

The Board also refused some requests. It will not “allowlist” particular processing activities, it did not write sector-specific chapters, and it did not change its view that informing people is important but is not, on its own, enough to shape their reasonable expectations.

The flowchart: the new assessment chart

The most practical addition is the annexed legitimate interest assessment flowchart. Before the three steps, it asks two preliminary questions. Have you identified the specific processing activity, its purpose, means and circumstances? And have you checked that EU or national law does not require a different legal basis or rule out legitimate interest? Only if both answers are yes do you move on. The second question matters for things like cookies and marketing emails, because the guidelines are expressly without prejudice to the ePrivacy Directive, which often requires consent no matter what your GDPR analysis says.

The chart ends with four follow-up actions: document the assessment, inform people about the purpose, the interest and their right to object, put the other GDPR requirements in place (rights handling, processor terms, transfers and, where needed, a DPIA), and keep the assessment under review. German regulators have offered similar tools before. Hamburg’s authority, for example, published a legitimate interest questionnaire. Now there is one EU-level reference that every authority signed off on.

A practical LIA walkthrough in six steps

Here is how to turn the final guidelines into an assessment that would survive a regulator’s questions. We use one running example: a software company that wants to analyse login and usage logs from customer accounts to spot account takeovers.

1. Pin down the processing and check the law first. Describe the activity narrowly: which logs, which fields, which systems, which people, how long. Then rule out a mandatory basis. If a sector law requires the monitoring, Article 6(1)(c) may be the right basis instead. If the processing involves reading information from a user’s device for something other than the service they requested, check the ePrivacy rules before going further.
2. Write the interest in one clear sentence. “Detecting and stopping unauthorised access to customer accounts” is clear, lawful, and present. “Improving our business” is too vague to assess. Under the final text, also note whose interest it is (yours, a third party’s, the public’s) and how much it weighs. Security and fraud prevention usually weigh more than convenience features.
3. Test necessity honestly. Ask whether you could reach the same goal just as effectively with less data, fewer people, shorter retention or one-off rather than continuous processing. In the example, keeping raw IP addresses for 30 days for anomaly detection may be defensible. Keeping full session histories forever is not.
4. Map the impact on people. The flowchart lists the factors: the nature of the data (special category data or “private” data such as location or finances), the scale, whether you combine datasets, the relationship with the person, whether children or vulnerable people are involved, and the further consequences, from financial loss to chilling effects. Record positive effects too. Account protection directly benefits the customer.
5. Judge reasonable expectations in context. The final text asks what people can justifiably expect, not just what is common in your sector. A customer expects their provider to watch for break-ins. They do not expect the same logs to feed ad targeting. Your privacy notice helps, but under the guidelines it does not settle the question on its own.
6. Balance, mitigate, decide and document. If people’s interests seem to override yours, you can add measures beyond the legal minimum, such as an unconditional opt-out before processing starts, erasure on request even where Article 17 would not require it, extra transparency, or a delay between collection and use. Then record how these measures change the result. If the balance still fails, legitimate interest cannot be used and the processing must stop unless another basis applies.

Keep the result alongside your records of processing activities, and update your notice so it names the interest and the right to object. If you are refreshing your GDPR privacy notice anyway, it is worth adding a short line saying people can ask for information about your balancing test.

Where the final text bites hardest

Direct marketing. The Board says it does not exclude direct marketing from legitimate interest altogether, but intrusive techniques such as extensive profiling remain harder to justify than simple mailings to existing customers. Electronic marketing also has its own consent rules. A recent Advocate General opinion on consent to unnamed partners for marketing emails shows how quickly those rules can override a GDPR legal basis analysis.

Fraud prevention. The final text recognises fraud prevention as a weighty interest that may serve the wider community, but asks controllers to name the specific type of fraud. That specificity drives the necessity test and keeps data collection proportionate.

AI development. A new paragraph confirms that building a conversational agent, a fraud-detection system or better threat detection may be legitimate interests, and points readers to Opinion 28/2024 for the necessity and balancing questions. For a wider comparison of how regulators frame this, see our analysis of the legal basis for AI training.

Children. The guidelines do not rule out legitimate interest for children’s data, but they require special protection and say separate guidance on children is coming.

Automated decisions. Article 6(1)(f) is not, on its own, a law authorising solely automated decisions under Article 22(2)(b).

UK organisations should note a divergence. The Data (Use and Access) Act 2025 created a list of recognised legitimate interests that skip the balancing test in the UK. Nothing like that exists in the EU, and the EDPB’s guidance applies the full test everywhere.

Frequently asked questions

Do we need to redo every existing assessment?

The three-step test is the same, so sound assessments stay valid. Review those that rely on vague interests, on mitigating measures the GDPR already requires, or on a privacy notice alone to justify expectations.

Is legitimate interest a “last resort” basis?

No. The Board repeats that there is no hierarchy among the six legal bases. It also warns against choosing legitimate interest simply because it seems less demanding than consent.

Must we publish our balancing test?

It isn’t required by law. The Board recommends, as a best practice, telling people they can request information about it, and you must name the interest pursued in your notice.

Does the flowchart replace a written LIA?

No. It sums up the reasoning. You still need a documented, case-specific assessment completed before processing begins.

Weigh it before you use it

The final guidelines leave little room for an LIA written to fit a conclusion you have already reached. The interest has to be specific, the data has to be necessary, and any safeguard you rely on has to do more than the GDPR already demands. Teams that work through the flowchart before launch, and keep the record up to date, will find legitimate interest easier to defend than its reputation suggests.