Category: Data Transfers

Compelling Legitimate Interests Transfer

Also known as: Compelling legitimate interests exception, Compelling legitimate interest transfer derogation

Simply put

This is a narrow exception that may, in limited situations, allow an organisation to send personal data to a country outside the UK (a 'restricted transfer') without using a standard transfer tool, where the transfer serves a compelling reason of the organisation's own that outweighs the impact on the individual. According to ICO guidance, it is intended only for one-off transfers and should be relied on only in exceptional circumstances. It is a last-resort route, not a routine mechanism, and it should be verified against the current official ICO guidance and UK GDPR text before use.

Formal definition

The compelling legitimate interests transfer is a derogation for restricted (international) transfers under the UK GDPR, distinct from the Article 6 'legitimate interests' lawful basis for processing and from transfer tools such as standard contractual clauses or adequacy decisions. Per ICO guidance, an organisation may make a restricted transfer where the transfer is not repetitive (typically a one-off), concerns a limited number of individuals, and is necessary for the purposes of a compelling legitimate interest of the controller (or, per commentary, a third party's) that is not overridden by the interests, rights and freedoms of the data subject. The threshold here is materially higher than the ordinary legitimate interests basis, which the ICO notes need not involve 'very compelling' interests; the ICO advises reliance only in exceptional circumstances and stresses that using it entails responsibility for protecting the individual's interests. This entry does not address the specific procedural safeguards, informing obligations, or documentation requirements attached to the derogation, and does not cite specific article or paragraph numbers, which practitioners should confirm against the current UK GDPR provisions and ICO international transfers guidance; equivalent EU GDPR treatment and any divergence should be verified separately.

Why it matters

The compelling legitimate interests transfer sits at the far end of the international transfer toolkit. Where an organisation cannot rely on a UK adequacy regulation, cannot put in place a transfer tool such as standard contractual clauses, and cannot satisfy any of the other specific exceptions (for example explicit consent or performance of a contract), this derogation may in narrow circumstances still permit a restricted transfer. Because it is described in ICO guidance as a route to be used only in exceptional circumstances, misunderstanding its scope creates real compliance risk: an organisation that treats it as a routine fallback may be making transfers without a valid basis.

A key source of confusion is that the term shares language with the Article 6 legitimate interests lawful basis for processing. The two are distinct, and the thresholds differ materially. The ICO notes that ordinary legitimate interests is a broad concept and the interests need not be 'very compelling', whereas this transfer derogation requires a compelling legitimate interest and applies only to transfers that are one-off, involve a limited number of individuals, and are not overridden by the interests, rights and freedoms of the data subject. Confusing the lower processing threshold with the higher transfer threshold can lead an organisation to over-rely on the derogation.

The practical significance is that this is a last-resort route carrying heightened responsibility. As the ICO frames it, relying on legitimate interests means taking on responsibility for protecting the interests of the individual. Because procedural safeguards, informing obligations, and documentation requirements attach to the derogation, and because the exact UK GDPR provisions and any EU divergence should be confirmed against current official text, organisations should approach it cautiously and verify the position before relying on it.

Who it's relevant to

Data protection officers and privacy leads

DPOs and privacy leads need to recognise this as a narrow, last-resort derogation rather than a routine transfer mechanism, and to ensure that adequacy, transfer tools, and other exceptions have been considered first. They typically own the judgement on whether a transfer genuinely meets the exceptional-circumstances threshold and is documented accordingly.

Privacy and data protection lawyers

Legal advisers are often asked to opine on whether a specific one-off transfer can rely on this derogation. They should distinguish it carefully from the Article 6 legitimate interests basis and from transfer tools, apply the higher 'compelling' threshold, and confirm the precise procedural and article-level requirements against the current UK GDPR text and ICO guidance before advising reliance.

Compliance and international operations teams

Teams managing cross-border data flows should understand that this derogation is generally unsuitable for regular or repetitive transfers, which typically require a transfer tool such as standard contractual clauses. It may be relevant only where a genuinely one-off transfer involving a limited number of individuals arises and no other route is appropriate.

Engineers and architects handling data flows

Those designing systems that move personal data outside the UK should flag any recurring or high-volume transfers to compliance colleagues, since those generally fall outside this exception. Understanding the one-off nature of the derogation helps avoid designing pipelines that assume a basis the organisation cannot properly rely on.

Inside Compelling Legitimate Interests Transfer

Legitimate interests as a transfer derogation

Under the GDPR's provisions on international transfers, where no adequacy decision and no appropriate safeguards (such as Standard Contractual Clauses or Binding Corporate Rules) are available, a transfer may in limited circumstances rely on the compelling legitimate interests of the controller. This sits within the derogations for specific situations rather than the primary transfer tools, and is generally treated as a last-resort basis to be interpreted restrictively.

Non-repetitive and limited nature

This derogation is typically available only where the transfer is not repetitive and concerns a limited number of data subjects. It is not designed for routine, systematic, or bulk transfer flows, which should instead rely on an adequacy decision or an appropriate safeguard.

Compelling legitimate interests of the controller

The controller must be pursuing interests that are compelling and that are not overridden by the interests, rights, and freedoms of the data subject. This is a higher threshold than the ordinary legitimate interests legal basis under Article 6, and requires the interests to be sufficiently weighty to justify the transfer in the absence of other mechanisms.

Assessment and balancing of transfer circumstances

The controller is generally expected to assess all the circumstances surrounding the transfer and, on the basis of that assessment, provide suitable safeguards for the protection of the personal data. This involves a documented balancing exercise weighing the controller's interests against the impact on data subjects.

Supervisory authority notification and data subject information

Reliance on this derogation generally triggers obligations to inform the competent supervisory authority of the transfer and to inform the data subject of the transfer and of the compelling legitimate interests pursued, in addition to the ordinary transparency obligations.

Distinction from Article 6 legitimate interests

The compelling legitimate interests transfer derogation is a mechanism for lawfully transferring data outside the EEA and is separate from establishing a lawful basis for processing. A controller relying on it still needs an appropriate Article 6 (and, where relevant, Article 9) basis for the underlying processing.

Common questions

Answers to the questions practitioners most commonly ask about Compelling Legitimate Interests Transfer.

Is the compelling legitimate interests ground a routine transfer tool like Standard Contractual Clauses?

No. This ground is not one of the primary transfer mechanisms such as adequacy decisions, appropriate safeguards (including Standard Contractual Clauses or Binding Corporate Rules), or the other derogations. It is generally understood to sit as a narrow, last-resort ground available only where no adequacy decision applies and no appropriate safeguards can be relied upon. It is intended for non-repetitive transfers concerning a limited number of data subjects, so it should not be treated as a substitute for the standard transfer tools. You should verify the precise conditions against the current official text of the Regulation.

Does relying on compelling legitimate interests mean I do not need consent or another Article 6 basis for the transfer?

These are separate questions and should not be conflated. A transfer generally requires both a lawful basis for the underlying processing (for example under Article 6, and an additional condition under Article 9 for special category data) and a valid ground for the international transfer itself. The compelling legitimate interests ground addresses only the transfer element; it does not remove the need for a legal basis for the processing. Note also that the legitimate interests transfer ground is distinct from the legitimate interests legal basis in Article 6, even though the terminology overlaps.

What steps are typically expected before relying on this ground?

In most cases, a controller is expected to first establish that no adequacy decision covers the destination and that appropriate safeguards, such as Standard Contractual Clauses or Binding Corporate Rules, are not reasonably available or workable, and that no other derogation applies. Regulator guidance generally treats this as a genuine last resort, so the controller should document why the standard tools could not be used. The reader should check the current guidance from the relevant supervisory authority, as expectations can vary between regulators.

How does the assessment and balancing exercise generally work in practice?

The controller is typically expected to assess all the circumstances of the transfer and to weigh its compelling legitimate interests against the interests, rights, and freedoms of the data subject. This generally involves identifying and applying suitable safeguards to protect the personal data. Because the outcome is context and risk dependent, this ground cannot be presented as always lawful; it requires a documented, case-by-case assessment rather than a standing justification.

What documentation and notification obligations are generally associated with this ground?

In most cases, the controller is expected to document the assessment of the transfer and the safeguards applied, and there is generally an expectation to inform the relevant supervisory authority and the data subjects about the transfer and the compelling legitimate interests pursued. The precise scope and content of these obligations should be verified against the current official text and applicable regulator guidance, as national implementing law and derogations may affect the position.

When is this ground typically unsuitable, and what are its scope limits?

This ground is generally unsuitable for repetitive, large-scale, or ongoing transfers, since it is understood to apply to transfers that are not repetitive and concern only a limited number of data subjects. Where transfers are systematic or high-volume, controllers should typically look to adequacy decisions, appropriate safeguards, or other mechanisms instead. There is recognized regulatory reluctance around this ground, and interpretation can diverge between supervisory authorities, so the reader should confirm the current position against official sources.

Common misconceptions

Compelling legitimate interests is an everyday transfer mechanism that can replace Standard Contractual Clauses.

It is generally treated as a derogation of last resort, available only where no adequacy decision and no appropriate safeguards can reasonably be used. It is typically limited to transfers that are not repetitive and involve a limited number of data subjects, so it is not a substitute for a transfer tool such as SCCs or BCRs for ongoing flows. Practitioners should verify the current position against the official text and regulator guidance, which continue to evolve.

If you already rely on legitimate interests as your Article 6 basis, the transfer is automatically covered.

The ordinary Article 6 legitimate interests basis for processing is distinct from the compelling legitimate interests transfer derogation. Having a lawful basis for processing does not by itself authorise an international transfer; the transfer requires its own mechanism, and the compelling threshold for the transfer derogation is generally understood to be higher than the standard legitimate interests balancing test.

Relying on this derogation involves no notification or documentation obligations.

In most cases the controller is expected to assess the circumstances, provide suitable safeguards, document its reasoning, inform the competent supervisory authority, and inform the affected data subjects of the transfer and the compelling interests pursued. The precise expectations can vary and are subject to supervisory authority guidance, so the applicable requirements should be checked against the current official sources.

Best practices

Treat this derogation as a genuine last resort: first assess whether an adequacy decision applies or whether an appropriate safeguard such as SCCs or BCRs can be used, and document why those options are unavailable or unworkable.

Confirm the transfer is non-repetitive and concerns only a limited number of data subjects before relying on this basis, and avoid using it to support routine or systematic transfer flows.

Carry out and record a documented balancing assessment weighing the controller's compelling interests against the interests, rights, and freedoms of data subjects, and identify the suitable safeguards adopted for the specific transfer.

Keep the transfer mechanism separate in your documentation from the Article 6 (and, where relevant, Article 9) lawful basis for the underlying processing, so the two are not conflated.

Prepare to inform the competent supervisory authority of the transfer and to provide affected data subjects with information about the transfer and the compelling legitimate interests pursued, in line with applicable transparency obligations.

Re-verify the availability and conditions of this derogation against the current official GDPR text and up-to-date regulator guidance, since transfer tools, adequacy decisions, and supplementary measure expectations continue to evolve and may diverge between EU and UK regimes.