The rule.
“except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject”
Verbatim extract, read on 4 November 2026 from the source below. Everything else on this page is NorthPoint’s plain-English reading.
What it requires.
- The processing is necessary for a legitimate interest of the controller or a third party, and that interest is not overridden by the person's interests, rights and freedoms — in particular where the person is a child.
- It is a GDPR basis only. Where the ePrivacy rules require consent for the channel (marketing email, cookies), legitimate interests does not replace it.
Who it applies to.
Controllers (not public authorities performing their tasks) that rely on legitimate interests for marketing processing such as postal marketing, audience analysis or existing-customer outreach.
Common violations in marketing copy.
We email B2C prospects under legitimate interests.
The ePrivacy rule for email to individuals requires prior consent, outside the soft opt-in.
No record of a balancing assessment for a profiling-based campaign
Without the balance, the basis is asserted, not established.
Non-compliant vs compliant.
“Legitimate interest covers everything we do with your data.”
“We send postal catalogues to past customers on the basis of our legitimate interests. You can object at any time — see our privacy notice.”
Related rules.
-
GDPR Article 6(1)(a) · European Union
-
GDPR Article 21(2)–(3) · European Union
-
ePrivacy Directive Article 13(1) · European Union
-
GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive 2002/58/EC.
Source.
| Instrument | Regulation (EU) 2016/679 (General Data Protection Regulation) |
|---|---|
| Provision | GDPR Article 6(1)(f) |
| Primary source | https://www.legislation.gov.uk/eur/2016/679/article/6/adopted |
| Official text | https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng |
| Read from | legislation.gov.uk's as-adopted copy of the Official Journal text (/eur/2016/679/article/N/adopted) |
| Checked |
This page is general, sourced information for marketing teams, not legal advice. The examples are written by NorthPoint to illustrate the rule; for a binding view on your own promotion, retain qualified counsel in the jurisdiction concerned.