On 10 November 2026, the European Data Protection Board adopted the final version of its guidelines on legitimate interest under Article 6(1)(f) GDPR. For businesses the news is mostly good. The final text is more workable than the 2024 draft, especially on assessments and marketing. It also makes a few points stricter, mainly on privacy notices and on data bought from third parties. Here is what companies need to know and what to do.

1. Assessments become easier to manage

Three changes reduce the paperwork:

• One assessment per processing. You do not need a separate legitimate interest assessment (LIA) for every single operation. One assessment can cover all the operations that make up the same processing. Different purposes still need separate assessments.
• Planned activities count. An interest qualifies if it relates to what you are doing now or to activities already planned for the near future. “Just in case” projects still do not.
• Stronger interests justify more. The guidelines now say openly that a significant interest can justify a greater impact on individuals than a trivial one. Explaining why your interest matters is now a real part of the assessment.

2. Your existing compliance now counts in the balancing test

This is the most useful change. The draft said that anything already required by the GDPR could not help you in the balancing test. The final text says the opposite: all measures that limit the impact on individuals count, including mandatory ones such as security, minimisation and transparency.

If the balance is still not in your favour, you can add extra measures. The EDPB suggests three types:

• More transparency: FAQs, information campaigns, graphic explanations, voluntary transparency reports.
• More control for individuals: an opt-out offered before processing starts, or deletion on request even where the GDPR does not require it.
• A waiting period: a reasonable gap between collecting data and using it, for example before the first marketing message.

Whatever you add, your LIA should explain how it changes the outcome.

3. Marketing: more room, with clear limits

• Soft opt-in is simpler. If you email your own customers about similar products and give them an easy way to opt out each time, the ePrivacy rules alone are enough. You do not need a separate GDPR legal basis to send the message.
• Personalisation can be a legitimate interest. Understanding customers’ preferences to tailor offers is now expressly recognised. Sending the same catalogue to existing customers is easy to justify.
• Tracking is not. Profiling based on large volumes of data, or tracking people across websites and devices, will very rarely pass the test. Use consent.
• More channels need consent. Besides email and SMS, the EDPB now names RCS and messaging apps. Check national rules too, especially for B2B marketing.
• Not just for companies. Associations, charities and political parties can also be doing direct marketing. Political advertising requires explicit consent under the EU regulation on political advertising.

4. Privacy notices: name your interest when you collect the data

This is the change with the most immediate impact. Following a 2025 Court of Justice ruling (Mousse), the guidelines state that you must tell people which specific legitimate interest you are pursuing when you collect their data. If you don’t, the collection cannot rely on legitimate interest at all.

Generic wording is not enough. The EDPB’s example is a privacy notice that says only “combating fraud”. You need to say which fraud you are trying to prevent.

5. Buying data? Check where it comes from

Under a June 2026 Court of Justice ruling (NTH Haustechnik), you cannot rely on legitimate interest to collect data you knew, or should have known, were obtained unlawfully by whoever passed them to you. This matters for lead lists, data brokers and AI training datasets. Due diligence on suppliers and contractual guarantees are now part of your defence.

6. Fraud prevention, AI and groups of companies

• Fraud. The draft required the fraud to be of “substantial importance”. That threshold is gone. The more serious the possible consequences of the fraud, the more weight your interest carries. Remember that fraud checks also affect honest customers.
• AI. Building a customer chatbot, detecting fraudulent content and improving threat detection are cited as interests that may be legitimate, with reference to the EDPB’s opinion on AI models and its guidelines on web scraping.
• Groups of companies. Moving customer data from a subsidiary’s CRM to a group CRM for reporting or IT security can rely on legitimate interest. So can telling employees about career opportunities or company events.

7. Points that are stricter

• DPIA. Where processing is likely to result in a high risk, a data protection impact assessment is required, not just recommended.
• Children. Profiling minors for marketing will generally not be compatible with their protection. The draft referred only to “extensive” profiling. Online platforms are also banned from showing minors ads based on profiling under the Digital Services Act.

What to do now

1. Update your LIA template. Add the weight of the interest, the measures you already apply, and any additional measures with their effect on the outcome.
2. Review your privacy notices. For each activity based on legitimate interest, state the specific interest in plain words.
3. Map your marketing. Separate soft opt-in, consent and legitimate interest, and move anything involving tracking to consent.
4. Check your data suppliers. Add origin checks and warranties to contracts for purchased data and AI datasets.
5. Keep it on file. The assessment must be done before the processing starts and be ready to show a supervisory authority.

Where to start

Start with the privacy notice and the LIA template: these are what an authority will look at first, and where the new case law bites hardest. Marketing and AI projects can follow, starting with anything that involves profiling.

The question to ask is not “can we use legitimate interest?”, but “could we explain our interest in one sentence to the customer whose data we are collecting?”

‍