§ 01
Definition
Article 6(1)(f) GDPR allows processing that is necessary for a genuine interest of the organisation or a third party, such as fraud prevention or network security, after a balancing test.
§ 02
How it works
The organisation must identify the interest, show the processing is necessary for it, and weigh it against the person's reasonable expectations and rights. People can object, and direct marketing objections must always be honoured. Cookie banners often list 'legitimate interest' toggles for ad partners, which regulators have criticised.
§ 03
Why it matters
Websites often cite legitimate interest to justify logging IP addresses for security. Knowing the term helps you read privacy policies, including a VPN provider's, and spot when it is being stretched.