Legitimate interest

What it means

Legitimate interest is one of the GDPR's six lawful bases. Recital 47 says processing for direct marketing may be regarded as carried out for a legitimate interest. Regulators describe a three-part test: a legitimate purpose, processing that is necessary for it, and a balance in which the person's interests, rights and reasonable expectations do not override yours.

For email it covers the data processing, not the sending rule. Where ePrivacy law requires consent for marketing email (to individuals, outside the soft opt-in), legitimate interest cannot replace it. Where it does not, as for many B2B messages, France's CNIL says prospecting professionals can rest on legitimate interest when the message relates to the person's job and they can object simply and free of charge.

The right to object to direct marketing is absolute.