Skip to main content
Praxikon

Free template · Word · English and Dutch

Legitimate interest assessment template for AI (Article 6(1)(f) GDPR)

A legitimate interest assessment (LIA) is the documented test a controller carries out before processing personal data on the basis of Article 6(1)(f) GDPR. For AI it is done per processing operation, such as training, use and log files, in three steps: the interest, necessity and the balancing of the data subjects' interests.

Last checked against the law
Editor
, jurist, privacy and AI
Version and template ID
2.0 · praxikon:template:ai-legitimate-interest-assessment
Legal basis
Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744

Who is this template for?

  • Organisations that develop, train or fine-tune an AI model with personal data (controller)Legal basis and accountability (Article 6(1)(f) and Article 5(2) GDPR)
  • Organisations that build, or have built, their own internal AI assistant on a purchased language modelProvider and deployer at the same time (Article 3(3) and (4) AI Act); transparency applicable since 2 August 2026 (Article 50(1) and (2))
  • Teams that scrape web data or use a purchased or scraped datasetDuty to inform and special category data (Article 14 and Article 9(2)(e) GDPR)
  • Data protection officerInforming and advising on the assessment (Article 39(1)(a) GDPR)
  • Privacy counsel or privacy officer setting up the objection routeRight to object (Article 21(1) and (4) GDPR)
  • HR and employee representatives where AI affects staffAutomated decisions (Article 22 GDPR) and national works council rights, for example Article 27 of the Dutch Works Councils Act

What is inside

  • Decision box with five questions: can you rely on legitimate interests here? (chapter 1)
  • Overview per processing operation (development, use, log files, improvement) and a description per processing operation (sections 2.1 and 2.2)
  • The roles under the GDPR and the AI Act side by side (chapter 2)
  • Step 1, the interest: examples of too vague and precise enough, and a test table (chapter 3)
  • Step 2, necessity: seven questions and a table of alternatives considered (chapter 4)
  • Step 3, the balancing test: fundamental rights, a risk table with eight AI risks, reasonable expectations and vulnerable data subjects (chapter 5)
  • Web scraping, with the Dutch supervisory authority's guidance as reference, special category data, informing data subjects and using someone else's model (chapter 6)
  • Eleven mitigating measures per phase, and which ones really count (chapter 7)
  • Conclusion and a checklist of what must be arranged afterwards (chapter 8)
  • Triggers for reviewing the assessment (chapter 9)
  • Worked fictional example of an internal AI assistant (chapter 10)

How to use the template

  1. Split the AI application into separate processing operations, such as training, use and log files, and complete the overview in section 2.1 for each one.
  2. Use the decision box in chapter 1 to test whether legitimate interest is available. If the decision box stops you, choose another legal basis or do not process.
  3. Work through the three steps for each processing operation (chapters 3 to 5), and chapter 6 if you scrape or use scraped data.
  4. Balance again after additional measures (chapter 7); only measures that go beyond what the GDPR already requires count.
  5. Ask your DPO for advice, record the decision and arrange the follow-up in chapter 8: records of processing, privacy notice, objection route, DPIA screening and contracts.
  6. Review the assessment at every substantial change and no later than one year after the decision (chapter 9).

Common mistakes

  • Writing one assessment for the whole AI application. Development, use and keeping log files are separate processing operations, often with different data subjects; each needs its own assessment.
  • Counting mandatory measures as additional safeguards. Security (Article 32 GDPR), data minimisation and a privacy notice are required anyway and cannot tip the balance.
  • Treating public data as free to use. Data being online does not make its use for AI training lawful; 'manifestly made public' (Article 9(2)(e) GDPR) requires an affirmative choice by the data subject.
  • Relying on legitimate interests where it is not available. Public authorities cannot rely on it in the performance of their tasks, and special category data also needs an exception under Article 9(2) GDPR.
  • Forgetting the right to object. The controller must explicitly bring it to the data subject's attention at the latest at the first communication (Article 21(4) GDPR) and have a working objection route, including for data in training sets and log files.

When do you need legal advice?

  • You train or fine-tune a model on data you did not obtain from the data subjects yourself. Think of scraped web data or a purchased dataset. The Dutch supervisory authority, for example, considers that in many cases it will be difficult for private organisations to scrape lawfully. The controller must then make a watertight case for the legal basis, special category data and the duty to inform (Article 14 GDPR).
  • The data includes special category data or data about children. Even if this is unintended or the model infers it. For special category data, legitimate interest is not enough: the controller also needs an exception under Article 9(2) GDPR. Where the data subject is a child, their interests weigh more heavily in the balancing test (Article 6(1)(f) GDPR).
  • The outcome affects people directly. The AI supports decisions about employees, job applicants or customers, or makes it possible to monitor employees. Then Article 22 GDPR comes into play, national law may require the consent of the works council (in the Netherlands, Article 27 of the Works Councils Act), and possibly the deployer obligations for high-risk AI apply (Annex III, point 4 or 5; from 2 December 2027). A balancing test alone is not enough.

Frequently asked questions

Is legitimate interest a valid legal basis for AI?

It can be, but only after an assessment for each processing operation. The controller must show that the interest is legitimate, that the processing is necessary and that the interests of the data subjects do not override it (Article 6(1)(f) GDPR). The EDPB set out these three steps for AI models in Opinion 28/2024 of 17 December 2024.

Is the AI Act itself a legal basis for processing personal data?

No. The AI Act does not affect the GDPR (Article 2(7)), with two strictly limited exceptions: Article 4a for processing special category data to detect and correct bias, and Article 59 for further processing in the AI regulatory sandbox.

Can a commercial interest be legitimate?

Yes. According to the Court of Justice in KNLTB (C-621/22, 4 October 2024), an interest does not have to be laid down in law, as long as it is not contrary to the law. The Dutch supervisory authority follows that line in its April 2025 guidance on scraping. Necessity and the balancing test must still hold.

Does the Digital Omnibus change the rules on AI and legitimate interest?

Possibly, later. On 19 November 2025 the European Commission proposed adding to the GDPR that developing and using AI can be a legitimate interest (COM(2025) 837, Article 88c in the proposal). As at 6 October 2026 that is not law, and even then a case-by-case assessment remains necessary.

Do I also need a DPIA?

Possibly. The legitimate interest assessment concerns the legal basis; the DPIA concerns high risks of the processing (Article 35 GDPR). Screen the DPIA obligation separately. For AI with employees as data subjects and new technology, that screening often leads to a DPIA, as in the example in chapter 10.

Can I use this template outside the Netherlands?

Yes. The template follows the GDPR and the AI Act, which apply in every Member State. Where national law matters, such as rules on special category data, works councils or cookies, Dutch provisions are given as examples; check the equivalent rules and any guidance from the supervisory authority in your own country.

May I adapt the template and share it within my organisation?

Yes. You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

Use and credit

You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

How to cite this template: Source: Praxikon, Legitimate interest assessment template for AI (Article 6(1)(f) GDPR), version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/ai-legitimate-interest-assessment

This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.

Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597