Most B2B marketers reach for consent as the only safe way to email a prospect in Europe. There is a second lawful basis that fits outbound work far better, and it is written right into the regulation. It is called legitimate interest, and it is widely misunderstood.
I have leaned on this basis to run compliant email marketing for B2B teams, and the trick is knowing where it applies and where it does not. Let’s break it down 👇
📌 On this page: What legitimate interest means, the three-part test that governs it, when you can use it for direct marketing, how it compares to consent, how to document a Legitimate Interests Assessment, and the mistakes that get it thrown out.
What is legitimate interest?
Legitimate interest is one of the six lawful bases under the GDPR that let an organization process personal data without asking for consent, as long as that processing is necessary for a genuine business purpose and does not override the individual’s rights and freedoms. It sits in Article 6(1)(f) of the regulation.
In plain terms, it is a permission you grant yourself after weighing your need against the other person’s privacy. You do not collect a checkbox. Instead, you reason through whether the person would reasonably expect what you are doing and would not be harmed by it, then you write that reasoning down.
It is the most flexible of the six bases, and also the one that carries the most responsibility, because the judgment call sits with you rather than with the data subject.
How the legitimate interest test works
The UK Information Commissioner’s Office frames legitimate interest as a three-part test. You have to pass all three parts before you start processing (Source: ICO).
1. The purpose test. Do you have a real, specific, and lawful interest? Vague goals like improving the business are rejected. The interest has to be current and clearly stated.
2. The necessity test. Is the processing actually needed to achieve that purpose? Necessary does not mean indispensable, but it does mean there is no less intrusive way to get the same result.
3. The balancing test. Do the individual’s interests, rights, and freedoms override yours? If a reasonable person would be surprised or harmed by what you are doing, the balance tips against you and the basis fails.
💡 Why it works: The balancing test rewards processing that people expect. A CFO listed on a company website expects relevant vendor outreach to a work address, so the balance often favors the sender. The same message to a personal Gmail account, scraped without context, tips the other way.
Legitimate interest and direct marketing
Recital 47 of the GDPR states that processing personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. That single line is why so much B2B marketing runs on this basis instead of consent.
Read it carefully, though. The word is may, not is. The European Data Protection Board clarified in 2024 that direct marketing is not automatically a legitimate interest. You still have to pass the three-part test, and the person always keeps an absolute right to object and stop the marketing.
This is where legitimate interest fits outbound sales and cold outreach well. When you contact a named business role about a product relevant to their job, using a corporate email, the expectation and necessity arguments are usually strong. It suits B2B lead generation far better than trying to collect consent from someone you have never spoken to.
🧠 Keep in mind: Legitimate interest never removes the right to object. Every marketing message still needs a clear opt-out, and once someone objects you must stop. In practice that looks a lot like the unsubscribe duty in US email law.
Legitimate interest vs consent
Both are valid GDPR bases, but they behave very differently. Choosing the right one depends on the processing, the relationship, and how sensitive the data is.
| Aspect | Legitimate interest | Consent |
|---|---|---|
| How permission is set | You assess and document it yourself | The person actively agrees, often via a checkbox |
| Typical collection | No opt-in needed up front | Freely given, specific, informed, unambiguous |
| Best fit | B2B outreach, fraud prevention, network security | Newsletters, cookies, sensitive data, B2C email |
| Withdrawal or objection | Person can object at any time | Person can withdraw at any time |
| Record you must keep | A Legitimate Interests Assessment | Proof of when and how consent was given |
A quick rule of thumb. If you are emailing consumers or handling sensitive categories of data, lean toward consent and a double opt-in flow. If you are doing targeted B2B outreach to work contacts, legitimate interest is usually the cleaner fit, provided you can defend the balancing test.
How to document a Legitimate Interests Assessment
A Legitimate Interests Assessment, or LIA, is the written record that shows you applied the three-part test to a specific activity. It is not optional busywork. A supervisory authority can ask for it during an audit, and without it the basis is hard to defend (Source: ICO).
A workable LIA does not need to be long. Capture these points and keep them on file:
- The specific purpose and why it is a genuine business interest.
- Why the processing is necessary, and what less intrusive options you ruled out.
- The categories of data and the people affected.
- The balancing analysis, including what those people would reasonably expect.
- The safeguards you apply, such as opt-outs, suppression, and data minimisation.
- Your conclusion and the date you reviewed it.
💡 Why it works: Writing the LIA before you send forces the balancing question early, while you can still change targeting or copy. Teams that skip it tend to discover the balance was wrong only after a complaint arrives, when it is far harder to fix.
Why legitimate interest matters for B2B teams
Get this basis right and you can run outbound programs in Europe without a consent wall that few cold prospects would ever complete. Get it wrong and you expose the business to complaints, objections you failed to honor, and regulatory attention.
There is a quieter benefit too. The discipline of the balancing test pushes you toward relevant, expected, well-targeted outreach. That same discipline protects your email deliverability, because messages people expect draw fewer spam complaints than a scattershot blast.
Common legitimate interest mistakes to avoid
Here are the errors I see most often when teams rely on this basis.
- Treating legitimate interest as a free pass. It is a test you can fail, not a blanket exemption.
- Skipping the written LIA, then having nothing to show a regulator.
- Ignoring objections. Once someone opts out, continuing to email them breaks the basis.
- Using it for sensitive data or children, where the balance almost always tips against you.
- Emailing personal addresses instead of business roles, which weakens the reasonable-expectation argument.
- Assuming it covers other regions. It is a GDPR concept and does not satisfy US or California rules on its own.
On that last point, remember the map is not one law. CCPA gives California residents their own rights, and US email is governed by the CAN-SPAM Act. Legitimate interest answers the GDPR question and only the GDPR question.
Where CUFinder fits
CUFinder is a B2B data provider, not a law firm, so it will not write your LIA or make the legal call for you. Where it helps is targeting quality. Verified business contacts and B2B data enrichment make it easier to reach named work roles rather than random personal inboxes, which is exactly the kind of processing the balancing test tends to favor.
You still own the assessment, the opt-out, and the objection handling. Clean, relevant data simply gives your legitimate interest argument a stronger footing to start from.
Frequently asked questions about legitimate interest
Is legitimate interest a valid basis for B2B marketing under GDPR?
Yes, in many cases. Recital 47 of the GDPR recognises direct marketing as a possible legitimate interest, and targeted B2B outreach to work contacts often passes the three-part test. It is not automatic, though. You must still document a Legitimate Interests Assessment and honor every objection.
What is the three-part legitimate interest test?
It has three stages: the purpose test (is your interest real, specific, and lawful), the necessity test (is the processing genuinely needed with no less intrusive option), and the balancing test (do the individual’s rights override your interest). You must pass all three before processing.
Do I need consent if I rely on legitimate interest?
No. Legitimate interest and consent are separate lawful bases under GDPR, and you only need one. If you rely on legitimate interest you do not collect an opt-in, but you must give a clear way to object and stop when someone asks.
What is a Legitimate Interests Assessment (LIA)?
An LIA is a written record showing you applied the three-part test to a specific processing activity. It captures your purpose, the necessity, the balancing analysis, and your safeguards. Supervisory authorities can request it, so without one the basis is difficult to defend.
Can someone object to processing based on legitimate interest?
Yes, and the right is absolute for direct marketing. Individuals can object at any time, and once they do you must stop marketing to them. This is why every message sent on this basis needs a clear, working opt-out.
Does legitimate interest apply outside the EU or UK?
No. Legitimate interest is a GDPR concept. It does not satisfy the California CCPA or the US CAN-SPAM Act, so contacts in those regions need their own compliance approach on top of your GDPR reasoning.
The bottom line
Legitimate interest is a genuine lawful basis, not a loophole. Pass the purpose, necessity, and balancing tests, write down your reasoning, and let people object, and you can run compliant B2B outreach in Europe without a consent wall.
Want verified business contacts that give your legitimate interest case a cleaner starting point? Get started today 👇
Bad
Okay
Good
Amazing
