How do you carry out a legitimate interest balancing test, and why does it need to be written down?

The interest must be specific and legitimate: protecting property from theft, ensuring network security, recovering a debt, informing existing customers about similar services. "Business needs" is not an interest — it is a category anything can be hidden under.

It helps to write down what would happen if the processing did not take place. If the answer sounds weak, the interest is probably too thin, and it is worth looking for a different legal basis.

The question is simple: can the same purpose be achieved with less intrusion? Would less data, a shorter period, a narrower zone, or a smaller group of recipients be enough? If so, legitimate interest only justifies the gentler option.

This is usually the step that changes the decision. Instead of ten cameras, four remain; instead of thirty days, fourteen; instead of the whole team having access, two people.

If the balance is doubtful, additional safeguards help: clear notice, a simple way to object, strict access controls, a shorter retention period. These are often exactly what tips the scale toward the permitted side.

A written test is the only proof that the decision was made deliberately and before the processing began. It is needed when responding to an individual who objects to the processing, and to a supervisory authority asking you to justify the legal basis. Reconstructing the reasoning from memory a year later is not possible.

One page is enough: the interest, necessity, balancing, the measures applied, the date, and who decided. The test is reviewed when the scope or purpose changes. For the wording of the legitimate interest basis, see Article 6(1)(f) GDPR.

Public authorities cannot rely on legitimate interest when carrying out their functions. It also does not apply when the processing is based on a legal obligation, or when consent is required to achieve the purpose — for example, in most cases of electronic marketing.

Legitimate interest alone is not enough for special category data: it needs a separate, additional legal basis. If health data or similar data is being processed, the balancing test will not replace that requirement.

The practical rule is simple: if the outcome depends on whether the person agrees, that is consent, not legitimate interest. For the rules on choosing a legal basis, see Article 6(1) GDPR.