This Practice Note addresses frequently asked questions (FAQs) on the new lawful basis of recognised legitimate interest which has been added to Article 6 of the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR) by the Data (Use and Access) Act 2025 (DUAA 2025), and key guidance from the UK data protection regulator, the Information Commission’s Office (ICO), on this new lawful basis. In addition to this new lawful basis under Article 6(1) of the UK GDPR, DUAA 2025, Pts 5 and 6 also serve to amend various other aspects of data protection law in the UK, including provisions relating to data subject rights, automated decision making, and the powers of the ICO. For further information on the changes DUAA 2025 introduces to UK data protection law, see Practice Note: The Data (Use and Access) Act 2025. What is the recognised legitimate interest lawful basis under the UK GDPR? A controller can only lawfully process personal data in compliance with the lawfulness, fairness and transparency principle under