What is legitimate interest?
Legitimate interest is a legal basis that lets a data controller process personal data without consent, provided its own genuine interest is not outweighed by the rights of the individual. It appears in Article 6(1)(f) of the GDPR and in Article 5/2(f) of the Turkish KVKK, which permits processing that is mandatory for the controller’s legitimate interests on condition that it does not harm the data subject’s fundamental rights and freedoms. It is the most flexible basis on paper and the easiest to misuse in practice.
The three-stage balancing test
- Purpose. Identify a real, lawful, present interest — fraud prevention, network security, intra-group administration — not a vague commercial wish.
- Necessity. Show the processing is actually needed for that purpose and that no less intrusive means would achieve it.
- Balance. Weigh the interest against the individual’s rights and reasonable expectations; if the impact is disproportionate or surprising, the basis fails.
The test must be run before processing starts and written down. A documented legitimate interest assessment is what separates a defensible position from an after-the-fact rationalisation.
The legal dimension
Under the GDPR, legitimate interest carries its own obligations: the interest must be named in the privacy notice, and the data subject holds a right to object. Under the KVKK the wording is stricter — processing must be mandatory for the interest — and the Turkish Board reads that word narrowly. Marketing illustrates the gap: electronic marketing in Türkiye is in practice built on explicit consent, and stretching legitimate interest to cover advertising databases is a recurring enforcement theme.
Turkish context
The KVKK Authority‘s practice treats Article 5/2(f) as an exception to be construed tightly, typically accepting it for matters such as employee administration or security measures closely tied to the controller’s operations, and rejecting it where consent was the honest route. Turkish subsidiaries of EU groups should not copy GDPR balancing templates unedited; the KVKK’s necessity threshold is higher and the documentation should say so.
Do: run and archive the balancing test before processing, and name the interest in your privacy notices. Don’t: use legitimate interest as a fallback for marketing you could not get consent for — that is the pattern regulators look for.
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call