CIPP/E UPDATES 2025 - the GDPR Legitimate Interest Test

The legitimate interest basis under Article 6(1)(f) of the GDPR is one of the most flexible options available to data controllers. Unlike consent or contractual necessity, it allows organizations to process data for their own purposes, provided they can justify that interest appropriately.

However, with flexibility comes scrutiny. The European Data Protection Board (EDPB) issued Guidelines 1/2024 to clarify when and how controllers can rely on legitimate interest lawfully. These updates are especially relevant for professionals preparing for the 2025 Certified Information Privacy Professional/Europe (CIPP/E) exam. The guidelines introduce a more detailed framework for assessing whether the controller's interest can be upheld without unduly impacting the rights of individuals.

The new guidance reflects growing regulatory concern about misuse of legitimate interest, particularly in contexts involving behavioral advertising, profiling, and vulnerable populations. For exam candidates and practitioners alike, a solid understanding of these updates is now essential.

The Three-Part GDPR Legitimate Interest Test

The EDPB’s interpretation of Article 6(1)(f) emphasizes a structured three-part test. Each part must be satisfied for the legal basis to apply.

Step One: Identifying a Legitimate Interest

A legitimate interest must be lawful, concrete, and present. It cannot be based on vague business goals like “improving services” or “increasing efficiency.” The interest must not conflict with other legal obligations, and it should be specific enough to be evaluated by a data protection authority if challenged.

For example, fraud prevention and ensuring network security are generally considered valid interests. Exercising or defending legal claims also falls within this category, provided the purpose is clear and connected to real operational needs.

The EDPB discourages the use of this basis when the interest is too abstract, speculative, or not demonstrably related to the processing activities.

Step Two: Assessing Necessity

Necessity requires that the data processing be essential for achieving the interest identified. This means that if the same goal can reasonably be met through less intrusive means, then the legitimate interest test cannot be fulfilled.

Organizations must carefully document their rationale. It's not enough to state that processing is helpful or efficient—it must be strictly necessary. For instance, if anonymized data can be used instead of personal data, that option must be chosen.

Evaluating necessity also involves understanding the scale and scope of processing. The more invasive the activity, the higher the burden on the controller to justify its use.

Step Three: Conducting a Balancing Test

The most complex component of the legitimate interest test is the balancing exercise. Here, the controller must weigh its interest against the potential impact on data subjects' rights and freedoms.

This balancing act includes several key factors: the type of data involved (such as sensitive or biometric data), the data subjects' reasonable expectations, and the safeguards applied. For example, people may expect their data to be used for security purposes, but not for profiling or behavioral advertising without consent.

If children are involved, or if the processing could lead to discrimination, exclusion, or distress, the balance may tip decisively in favor of the data subject. In these cases, legitimate interest is unlikely to be the appropriate legal basis.

When Legitimate Interest Is Not Enough

There are clear boundaries around when legitimate interest can and cannot be used. Some types of processing are better suited to other legal bases, and forcing a fit can lead to non-compliance.

Take, for example, online tracking and the use of cookies. Under the ePrivacy Directive, these activities generally require prior consent, regardless of whether a legitimate interest might exist. Attempting to bypass consent in such cases goes against both EU and national regulations.

Similarly, direct marketing may qualify under legitimate interest, but only if recipients are clearly informed and given the opportunity to object. If they do object, processing must cease immediately.

Moreover, Article 21 of the GDPR gives individuals the right to object to processing based on legitimate interest. Controllers must have a process in place to evaluate and honor such objections. Article 17, which grants the right to erasure, may also apply if the interest no longer justifies retaining the data.

The Importance of Documenting the Assessment

One of the strongest messages from the EDPB in its 2024 guidance is the need for transparency and accountability. Documenting the legitimate interest assessment is no longer optional; it is a core part of compliance.

This includes clearly outlining how the interest was identified, why the processing is necessary, and how the rights of the data subjects have been considered and safeguarded. The documentation should also cover mitigation steps, such as pseudonymization, encryption, or data minimization strategies.

Without this record, a controller may struggle to defend its position in case of a complaint or supervisory authority audit. In the CIPP/E context, understanding the depth of this requirement can help students prepare for both exam scenarios and real-world responsibilities.

Preparing for the CIPP/E Exam

The 2024 EDPB Guidelines on legitimate interest are now an integral part of the evolving CIPP/E curriculum. In response, the 22Academy courseware is being updated to reflect these changes, ensuring that candidates preparing for the exam, whether before or after the September 2, 2025 syllabus transition, have access to accurate and up-to-date material.

The updated EDPB Guidelines booklet, already available, includes a dedicated section on the legitimate interest test as interpreted by the new guidance. This booklet forms part of the full 2025 CIPP/E Prep Suite and is also available separately for focused study.

As the rest of the courseware is brought in line with the revised expectations, learners will gain the knowledge needed to assess when legitimate interest applies and how to structure a compliant and well-documented justification under Article 6(1)(f). These updates support a deeper understanding of the legal, necessity, and balancing requirements, which are essential to both exam success and practical application.