This Practice Note explains the scope for relying on legitimate interest as a lawful ground for processing personal data under the UK General data protection Regulation (UK GDPR). It is based on the requirements of the UK GDPR, together with

1. •

   detailed guidance from the Information Commissioner’s Office (ICO): legitimate interests under the UK GDPR, and

2. •

   European Data Protection Board (EDPB) Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR—according to the ICO, EDPB guidelines are no longer directly relevant to the UK regime and are not binding under the UK regime, however they may still provide helpful guidance on certain issues

For guidance on conducting a legitimate interests assessment (LIA), see Practice Note: How to conduct a legitimate interests assessment. See also Precedent: Legitimate interests assessment—data processing and Legitimate interests assessment flowchart.