Skip to main content
Praxikon

Guideline

Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (legitimate interest)

Date
Status
adopted
Body
European Data Protection Board (EDPB)
Reference
Guidelines 1/2024, versie 1.0 (consultatie 10/2024)

What it is about

The EDPB describes three cumulative conditions for relying on legitimate interest: a lawful, clearly articulated and present interest, necessity of the processing, and a balancing test in which the data subject's rights do not override that interest. The controller must assess and document this before processing starts. The text takes account of CJEU judgment C-621/22 (KNLTB, 4 October 2024) and covers fraud prevention, direct marketing and network and information security. Version 1.0 was adopted on 8 October 2024 for public consultation, which ran from 9 October to 20 November 2024. As of 15 September 2026 the EDPB has published only version 1.0; there is no final version yet.

What this means in practice

You document a balancing test (LIA) per processing operation before you start and can demonstrate it. You review the test when the purpose or scope of the processing changes, and you inform data subjects of the interest pursued. For direct marketing, objecting must always be easy and free of charge (Article 21(2)) and an objection always wins. For other processing, such as fraud prevention, the general right to object of Article 21(1) applies, and you must show compelling legitimate grounds to continue.

The GDPR articles concerned

Source: EDPB public consultation page and Guidelines 1/2024 version 1.0 (PDF)checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 13

Guidelines8 of 12

Enforcement and fines8 of 13

Legislation in motion6 of 9