Legitimate Interests

Legitimate interests is one of the six lawful bases for processing personal data under Article 6(1)(f) GDPR. It allows processing without consent when it is necessary for a genuine interest of the business or a third party, and that interest is not overridden by the rights and interests of the person concerned.

What are legitimate interests?

Legitimate interests is the most flexible of the six lawful bases in Article 6(1) of the GDPR and the UK GDPR. Under point (f), you may process personal data without asking for consent if the processing is necessary for a legitimate interest you or a third party pursue, and that interest is not overridden by the interests, rights and freedoms of the individual.

Flexible does not mean automatic. You have to be able to show that you weighed it up. The UK Information Commissioner’s Office (ICO) frames this as a three-part test:

  1. Purpose test: are you pursuing a legitimate interest? Commercial interests such as customer service, fraud prevention or direct marketing can qualify.
  2. Necessity test: is the processing necessary for that purpose, or is there a less intrusive way to achieve the same result?
  3. Balancing test: do the individual’s interests override yours? Key questions are whether the person would reasonably expect the processing and whether it could harm them.

Two consequences follow. First, people have a right to object under Article 21. For direct marketing, that right is absolute: once someone objects, you stop. Second, you should document the assessment, often called a legitimate interests assessment (LIA), and reference it in your records of processing activities.

Why it matters for messaging

For business messaging, the key point is that data protection law is not the only rule in play. Electronic marketing has its own rules on top:

  • UK: the Privacy and Electronic Communications Regulations (PECR) require consent for marketing emails and texts to individuals. The exception is the “soft opt-in”: existing customers can receive marketing about similar products if they were given a chance to opt out when their details were collected and in every message.
  • EU: the ePrivacy rules, implemented nationally, follow a similar logic, and many markets expect a double opt-in for email newsletters.
  • US: marketing texts are regulated by the Telephone Consumer Protection Act (TCPA), which requires prior express written consent for automated marketing messages.

In practice, that leads to a simple split. Transactional and service messages, such as an order confirmation, a delivery update or an appointment reminder, can usually rely on the contract (Article 6(1)(b)) or on legitimate interests. Marketing to people who are not existing customers almost always needs consent. Getting this wrong is not only a data protection issue; it can also trigger regulator action or claims under the marketing rules.

Example: an online furniture shop

A UK online furniture shop sends customers WhatsApp updates when their sofa ships and when the delivery van is on its way. These messages are expected, useful and directly tied to the order. The shop relies on the contract and on legitimate interests, documents its reasoning, and lets anyone opt out of non-essential updates.

The same shop also wants to send a monthly newsletter with new collections. For people who have never bought anything, that needs consent: they sign up through a form, confirm their email address and can unsubscribe in one click. Both types of messages land in the same inbox for the team, but they are clearly separated in the system: service updates on one basis, marketing on another.

Legitimate interests and SendSeven

SendSeven does not decide your lawful basis; that is your call as controller. The platform helps you keep the two worlds apart and document them:

  • Consent and opt-outs per contact: each contact has a subscriptions view showing what they have agreed to. See consent management.
  • STOP and START handled automatically on WhatsApp, SMS, Messenger, Instagram and Telegram, and one-click unsubscribe in marketing emails.
  • Service and marketing separated, so a delivery update never turns into a campaign by accident.
  • Hosted in the EU (Frankfurt), with a DPA under Article 28.

More on the full picture in GDPR-compliant messaging.

This is general information, not legal advice. Check the details with your data protection lead or compliance consultant.