Last reviewed:
Translated from German; if the versions differ, the German version applies.
Not legal advice: Legal content on this page appears only as verbatim quotations from statutes, court rulings or authority papers, with their source; quotations from German texts are our working translations. We do not assess them ourselves, and no lawyer has reviewed this page. It is no substitute for legal advice in your individual case.
Legitimate interest
In short: “Legitimate interest” is the common name of one of the legal bases that the EU General Data Protection Regulation (GDPR) lists in Art. 6(1) for processing personal data. It is point (f). This page shows the wording and what the recitals and the German data protection authorities write about it in connection with advertising.
The wording
Quotations from German authority papers are our working translations; only the German wording is authoritative (see the German version of this page). GDPR quotations follow the official English text.
Art. 6(1) GDPR begins: “Processing shall be lawful only if and to the extent that at least one of the following applies:”. Point (f) reads:
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” — Art. 6(1)(f) GDPR
On advertising, the last sentence of Recital 47 states: “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” The same recital also says: “The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing.”
What the data protection authorities write
On the balancing in general: “The GDPR requires a balancing of the interests of the controller or third parties and of the data subject in the specific individual case. Merely relying on abstract or comparable cases without taking into account the particularities of the individual case (the specific advertising project) does not satisfy the requirements of the GDPR.” (Guidance of the German data protection authorities (Datenschutzkonferenz, DSK) on direct marketing, February 2022, section 1.3.1, p. 4, our translation)
On the relationship with Section 7 of the UWG (the German Act against Unfair Competition, Gesetz gegen den unlauteren Wettbewerb): “Section 7 UWG governs in which cases an unacceptable nuisance to those targeted by advertising is to be assumed and advertising of this kind is not permitted. If a particular channel of contact with a data subject is not permitted for the advertising controller under that provision, there is already no legitimate interest.” (section 1.4, p. 6, our translation)
Whether a particular newsletter can be based on this legal basis is not something we answer; the quoted texts themselves call for a balancing in the individual case.
How it differs
- Legitimate interest and consent: Consent is another condition in Art. 6(1), namely point (a): “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”. More under Consent.
- Legitimate interest and Section 7(3) UWG: The rule for existing-customer advertising is in the UWG, not in the GDPR. How the authorities link the two is shown by the quotation from section 1.4 above.
- Legitimate interest and objection: For direct marketing, Art. 21(2) GDPR provides a right to object that applies “at any time” (Objection).
Easily confused
- “Interest” in everyday language: In the law, the controller’s interest is only one part. On the other side, the wording names the interests and fundamental rights of the data subject, which may override it.
- Legitimate interest in the privacy information: Art. 13(1) GDPR begins: “Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:”. Point (d) reads: “where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;”
Example from the wording
Recital 47 itself gives an example of when a legitimate interest could exist: “Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller.” The authorities’ practical cases on advertising after an order, with and without profiling, are quoted verbatim on the page Segmentation and personalisation.
Frequently asked questions
What is a legitimate interest? The common name of the legal basis in Art. 6(1)(f) GDPR. The wording is shown in the section above.
Is a legitimate interest enough for a newsletter? We do not answer this. The German data protection authorities write that the GDPR requires “a balancing of the interests of the controller or third parties and of the data subject in the specific individual case” and, on Section 7 UWG: if a channel of contact is not permitted under it, “there is already no legitimate interest” (guidance, sections 1.3.1 and 1.4, our translation).
What does legitimate interest have to do with the privacy policy? Art. 13(1)(d) GDPR lists the legitimate interests pursued among the information that the controller provides at the time of collection; the wording is in the section “Easily confused”.
Related terms
Matching tool
- There is no tool for this term; our tools do not answer legal questions.