What does section 11(1)(f) say?
“(f) processing is necessary for pursuing the legitimate interests of the responsible party or of a third party to whom the information is supplied.”
Two features deserve attention. First, “necessary” — the ground covers what the interest genuinely requires, not everything vaguely useful. Second, “or of a third party to whom the information is supplied” — the subsection expressly contemplates disclosure to others with legitimate interests, which is why it anchors so much lawful sharing.
What legitimate interests carries in practice
This is the ground that exists precisely so that ordinary, sensible business activity does not need consent: fraud prevention, physical and IT security, CCTV at premises, debt recovery and handing over defaulters, internal administration and reporting, giving a reference to a prospective employer, vetting counterparties, and sharing within a group of companies. In each case the question is the same: is this processing necessary for a real, lawful interest — and does that interest survive the balance against the data subject’s privacy?
The three-part assessment: purpose, necessity, balancing
Legitimate interest must be earned, not assumed. The Information Regulator’s Guidance Note on Direct Marketing (3 December 2024) says so directly — and although it speaks in the marketing context, its three-part assessment is the right discipline for any section 11(1)(f) reliance:
“The reliance on legitimate interest as a legal justification is not automatic. The onus is on the responsible party to justify the use of legitimate interests as the relevant basis for the processing of personal information.”
The assessment it prescribes: purpose — is there a real, lawful interest behind the processing? Necessity — is the processing actually needed to pursue it, or is there a less intrusive way? Balancing — does the interest outweigh the impact on the data subject, judged by their reasonable expectations and the sensitivity of the information? Write the three answers down. A one-page record is the difference between relying on the ground and merely hoping.
The limits: objection — and the section 69 carve-out
Legitimate interests is balanced by the data subject’s right to object on reasonable grounds — and if a valid objection lands, section 11(4) is blunt: the processing stops. And one whole territory is carved out entirely: electronic direct marketing. However legitimate your interest in selling, section 69 imposes its own consent-or-customer regime for email, SMS and (in the Regulator’s view) phone calls — legitimate interests cannot substitute for it. The split is mapped on the direct-marketing page.