Lawful Basis & Legitimate Interests Assessment Check

Every use of personal data under the UK GDPR needs a lawful basis under Article 6: consent, contract, legal obligation, vital interests, public task or legitimate interests. Choosing the wrong one, or not recording why you chose it, is one of the most common data protection failings. Legitimate interests is the most flexible basis, but it requires a three-part test (purpose, necessity and balancing) and the ICO expects a documented Legitimate Interests Assessment (LIA) wherever you rely on it. Your privacy notice must also state the basis for each purpose, under Articles 13 and 14.

The Data (Use and Access) Act 2025 is amending the UK GDPR, including by introducing a list of “recognised legitimate interests” for specific purposes such as crime prevention and safeguarding, which do not need the balancing test. Businesses still need to work out which purposes qualify and keep their records up to date. The ICO can issue fines of up to £17.5 million or 4% of global turnover for breaches of the core principles, and a poorly justified lawful basis also undermines consent, marketing and data subject rights handling that depend on it.

Use this free tool to check whether you have chosen, justified and documented the right UK GDPR lawful basis for your use of personal data. Get a clear, plain-English action plan in minutes.