Assess whether Article 6(1)(f) can support a processing activity by recording the legitimate interest, necessity analysis, balancing outcome, and objection handling.
Use this workflow to keep privacy notices, RoPA entries, approvals, and reassessment triggers aligned with GDPR Articles 5, 6, 13, 14, 21, and 30.
Structured answer sets in this page tree.
Cited legal and guidance references.
This workflow is for GDPR processing activities where a controller wants to rely on legitimate interests under Article 6(1)(f). The record should show the specific purpose, why the processing is necessary for that purpose, whether the controller or third-party interest is overridden by data-subject interests or rights, and how Article 21 objections will be handled.
Create one LIA record per processing purpose, not one record for an entire product, department, or data platform. Article 5 requires specified, explicit, and legitimate purposes, and Article 6 requires at least one lawful basis for the processing.
Record the candidate Article 6 basis before controls are designed. If the activity depends on consent, contract, legal obligation, vital interests, public task, or special-category processing rules, do not force it into Article 6(1)(f); use this workflow only for the legitimate-interests candidate and document why other Article 6 bases were not selected.
The Article 6(1)(f) test should be written as three separate decisions. A valid interest alone is not enough; the processing must be necessary for that interest and must not be overridden by the data subject interests or fundamental rights and freedoms that require protection of personal data.
Keep the necessity analysis factual. Describe the minimum data, retention, recipients, automation, and access needed to meet the stated purpose, then identify any less intrusive alternatives that were accepted or rejected.
Article 21 gives data subjects the right to object, on grounds relating to their particular situation, to processing based on Article 6(1)(e) or Article 6(1)(f), including profiling based on those provisions. The LIA should therefore include the operational path for receiving, triaging, and deciding objections before the processing goes live.
For Article 6(1)(f) processing, the controller must stop processing after an objection unless it can demonstrate compelling legitimate grounds that override the data subject interests, rights, and freedoms, or the processing is needed for legal claims. Direct marketing objections require a separate stop path because Article 21 says the personal data must no longer be processed for that purpose.
Treat the LIA as a live evidence record tied to the RoPA and privacy notice. Article 30 records require the purposes of processing, data-subject and personal-data categories, recipients, transfers, erasure time limits where possible, and security measures where possible; DPC guidance also identifies Article 6 legal basis as a helpful extra field.
The evidence should let a reviewer see the chain from Article 6(1)(f) to implementation: purpose, necessity, balancing, safeguards, notice text, objection handling, and owner approval. Avoid storing only a final yes or no outcome without the facts that made the decision supportable.
Sorena can help convert lawful-basis decisions into LIA records, RoPA fields, privacy-notice language, objection-handling steps, and reassessment triggers grounded in the cited GDPR sources.
Ask source-linked questions about Article 6(1)(f), Article 21 objections, transparency, and RoPA evidence using the cited sources on this page.
Review your lawful-basis inventory, LIA evidence gaps, and objection-handling workflow with Sorena.
"What is my reason or justification for processing this personal data?"
"The Article 6 legal basis for processing"
"processing is necessary for the purposes of the legitimate interests"