Legitimate interest assessment (LIA) checklist

Read the document to make sure it meets your needs and that you’ve provided all of the necessary information about your organisation’s data processing.

Remember that, if you have identified potential for a high risk to occur, you will need a compelling legitimate interest to rely on legitimate interest as the legal basis for your processing. You will also need to carry out a Data protection impact assessment.

Similarly, if individuals are likely to object to the data processing (eg because they find it intrusive), in order to rely on legitimate interest for the processing you will need a compelling legitimate interest to show that the interests in the processing outweigh the objections. 

Read Legitimate interest assessments for more information. Remember that, if you have any questions, you can Ask a lawyer for advice.

While not strictly necessary, it’s good practice for organisations to publish their finalised LIAs to help them meet transparency and accountability obligations. Publishing LIAs can increase trust in your organisation’s data processing practices and can improve individuals’ abilities to exercise their rights in relation to personal data.

A Legitimate Interest Assessment must be kept under regular review after it’s been created and once the data processing has begun. The LIA may need to be repeated if there are any significant changes (eg to the nature, scope, context, or purposes of the data processing) that may affect the balance between your organisation’s interests and the risks posed to individuals.

For more information, read Legitimate interest assessments.

You should download your completed LIA and store it. Make you store any previous versions of your LIA if you later review and update it and record the date that each Assessment was carried out. 

A copy of your LIA will also be stored automatically in your Rocket Lawyer account ‘Dashboard’.