Legitimate interest assessment (LIA) checklist

Read the legitimate interest assessment (LIA) to make sure it meets your needs. Remember that if you have identified potential for a high risk to occur, you will need a compelling legitimate interest to rely on legitimate interest for the processing. You will also need to carry out a Data protection impact assessment.

Similarly, if individuals are likely to object to the data processing (eg because they find it intrusive), you will need a compelling legitimate interest to show that the interests in the processing outweigh the objections, in order to rely on legitimate interest for the processing.

Read Legitimate interest assessments for more information and remember that if you have any questions you can easily Ask a lawyer.

While not necessary, it is considered to be good practice to publish finalised LIAs to abide by transparency and accountability obligations. Doing this can increase trust in your organisation’s data processing activities and facilitate and improve individuals’ ability to exercise their rights in relation to personal data.

Once an LIA has been completed, and the processing takes place on the ground of legitimate interest, the LIA must be kept under regular review. An LIA may need to be repeated if there are any significant changes (eg to the nature, scope, context or purposes of the data processing) that may affect the balance between your organisation’s interest and the risks to the individuals.

For more information, read Legitimate interest assessments.

Your organisation should keep the original LIA.

A copy of the LIA will also be stored under ‘My Documents’ in your Rocket Lawyer account.