A Lawful Basis to Cover Your Bases: Recognised Legitimate Interest

For any organisation, data protection compliance begins with a fundamental question: what lawful basis permits you to process personal data?

Recent complaint data published by the Information Commissioner’s Office (ICO) shows why that question isn’t just a technicality. Between April and June 2026, complaints concerning the core lawfulness, fairness and transparency principle were second only to subject access request complaints.

Whilst not every complaint resulted in a finding of infringement, these figures do show that lawfulness and transparency remain key areas of scrutiny.

What you need to know

An organisation processing personal data must not only identify an appropriate lawful basis for doing so, but also understand why it applies, document its reasoning and explain the position clearly to individuals. These are fundamental requirements, without which processing personal data may be unlawful.

Processing personal data is a broad term but can include collecting and recording data, sharing personal data and updating personal data. This means that a lawful basis is essentially a legal justification to handle and use personal data. If you can achieve the same outcome for your organisation without processing personal data, there will be no legal justification necessary but the likelihood is that you need to process personal data to operate!

What is a “lawful basis” for handling personal data and why do I need one?

Under Article 6 of the UK GDPR, there were originally six lawful reasons to handle personal data. These are, in summary:

1. consent;
2. processing is necessary to perform a contract to which the data subject is party;
3. processing is necessary to comply with a legal obligation on the controller;
4. processing is necessary to protect the vital interests of the data subject or someone else;
5. processing is necessary to perform a task carried out in the public interest;
6. processing is necessary for the purposes of the “legitimate interests”, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

A seventh reason – “processing is necessary for the purposes of a recognised legitimate interest” was introduced from 5 February 2026.

If personal data is processed without a lawful basis, the organisation can be in breach of data protection rules leaving them vulnerable to:

• Fines or other enforcement action by the ICO;
• A data protection complaint; and/or
• A civil claim for compensation/loss/damage for infringing an individual’s data rights.

What is a “recognised legitimate interest” for processing personal data?

The original “legitimate interests” basis – which is still available – requires data processers to assess whether a person’s rights, freedoms or interests outweigh the legitimate interest relied on. The new basis of “recognised legitimate interest” removes this requirement, effectively setting out a pre-approved list of interests which will always trump personal rights, freedoms and interests.

The five scenarios where this is the case are:

• Safeguarding “vulnerable” people;
• Responding to emergencies;
• Preventing or investigating crime;
• National security, public security and defence; and
• Sharing personal information to help other organisations perform their public tasks or official functions.

Organisations must still demonstrate necessity and comply with the wider UK GDPR framework.

When might a recognised legitimate interest arise? The ICO provides a helpful example.

Top tips for compliance

There are a number of steps that can be taken to ensure compliance when processing personal data:

• Maintain appropriate records of the decision-making process, including the lawful basis relied upon, any supporting evidence, relevant correspondence, privacy notices, retention periods and any legitimate interests assessments or data protection impact assessments that have been conducted.
• Document all contextual factors that have led to the processing of the personal data. This should include the circumstances giving rise to the processing, the purpose being pursued, the categories of personal data involved, any relevant requests received and the reasons why the processing is considered necessary.
• A holistic review of the proposed processing activity should be undertaken before any personal data is processed.

Following these steps will encourage compliance with the UK GDPR and help organisations demonstrate accountability should their processing activity be questioned. It may also reduce the risk of complaints being raised with the ICO. Our data protection team at Tozers can help you with this work, as well as defending you with any escalation.

Why use Tozers for data protection matters?

Our expert data protection team prides itself in breaking down complex legal terms to simplify the process for you. Our aim is to provide tailored advice to organisations with the aim of providing actionable and practical steps, ensuring you feel confident and informed throughout your data protection journey.

If you need any assistance with processing personal data or general data protect, please do not hesitate to contact our team today.

Contact our legal experts