Skip to main content
Privacy Track
Category: Lawful Basis for Processing

Legitimate Interest of a Third Party

Also known as: Third Party Legitimate Interests, Third-Party Legitimate Interest Basis
Simply put

Legitimate interest is one of the lawful reasons an organisation can use to justify processing personal data, and that interest does not always have to be the organisation's own. In some cases, a controller can rely on the legitimate interest of another party (a third party) as the justification, provided there is a clear and specific benefit or outcome in mind. This basis still requires balancing that interest against the rights and interests of the individuals whose data is processed, so it is not automatically available.

Formal definition

The 'legitimate interests' lawful basis permits processing where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, subject to a balancing test against the interests, rights, and freedoms of the data subject. According to ICO guidance, the relevant legitimate interest may be the controller's own or that of a third party, and can encompass commercial, individual, or broader interests; relying on the basis generally requires identifying a clear and specific benefit or outcome rather than a vague or speculative one. This entry addresses the lawful basis under Article 6 of the UK GDPR as described in ICO guidance; the evidence provided does not detail the full three-part legitimate interests assessment (purpose, necessity, and balancing), the treatment of children's data, or any additional condition required for special category data under Article 9. Practitioners should note that the availability of this basis is context-dependent and subject to assessment, and should verify the precise statutory wording and current regulator guidance against the official text, as the evidence here does not reproduce the full Article 6 provision.

Why it matters

Legitimate interests is one of six lawful bases available under Article 6 of the UK GDPR, but a point that is frequently overlooked is that the interest being relied upon does not have to belong to the controller doing the processing. According to ICO guidance, a controller may rely on the legitimate interests of a third party as the justification for processing, provided there is a clear and specific benefit or outcome in mind rather than something vague or speculative. This matters because it broadens the range of situations in which the basis may, subject to assessment, be available, and it means organisations should not assume that the absence of a direct benefit to themselves rules the basis out.

At the same time, the third-party dimension does not weaken the safeguards that attach to legitimate interests. The basis remains subject to a balancing exercise against the interests, rights, and freedoms of the individuals whose data is processed, so it is never automatically available simply because a third party stands to benefit. In practice, the identity of the third party and the nature of the benefit they seek are relevant inputs to that assessment, and a controller relying on someone else's interest still bears responsibility for demonstrating that the processing is justified.

Because the availability of this basis is context-dependent and turns on the specifics of each processing operation, organisations should document their reasoning carefully. The evidence here does not reproduce the full Article 6 provision or set out the complete three-part legitimate interests assessment, and it does not address special category data or children's data, so practitioners should verify the precise statutory wording and current ICO guidance against the official text before relying on this basis.

Who it's relevant to

Data Protection Officers and compliance leads
DPOs and compliance teams assessing lawful bases need to recognise that a legitimate interest may be that of a third party, not only the controller's own. When documenting a legitimate interests assessment, they should identify the specific third-party benefit or outcome and record how it was balanced against the rights of the individuals concerned, keeping in mind that availability of the basis is context-dependent and subject to assessment.
Privacy lawyers and advisers
Legal advisers evaluating whether processing can proceed on a legitimate interests footing should consider whether a third party's interest is engaged and whether it can be articulated with sufficient clarity. They should verify the precise statutory wording under Article 6 of the UK GDPR and current ICO guidance, and flag that the evidence available does not cover special category data conditions or children's data.
Engineers and product teams designing data-driven services
Teams building features that involve sharing or processing personal data for the benefit of another party should understand that a third-party legitimate interest may be a candidate lawful basis, but only where a clear and specific benefit is identified and the balancing test is satisfied. They should engage privacy colleagues early rather than assume the basis is automatically available.
Controllers involved in data sharing arrangements
Organisations that process data in ways that serve another entity's interests should carefully assess whether they are relying on their own or a third party's legitimate interest, and ensure the reasoning is documented. The distinction can affect how the balancing exercise is framed and how the position is explained to individuals in transparency information.

Inside Legitimate Interest of a Third Party

Legitimate interests legal basis (Article 6(1)(f))
The provision under the GDPR that permits processing where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, subject to a balancing test against the interests, fundamental rights, and freedoms of the data subject. It is one of the six distinct Article 6 lawful bases and is not a default or catch-all.
Third party as beneficiary of the interest
Article 6(1)(f) expressly recognises that the relevant legitimate interest may be pursued not only by the controller itself but by a third party. This means the controller may rely on this basis where the processing serves an interest held by another party, provided the other conditions are met.
Three-part assessment
Reliance on this basis is generally understood, following regulatory guidance and case law, to require a three-part analysis: (1) identifying a legitimate interest (of the controller or third party); (2) demonstrating that the processing is necessary to achieve that interest; and (3) a balancing exercise weighing the interest against the data subject's interests, rights, and freedoms, with attention to their reasonable expectations.
Necessity requirement
The processing must be necessary for the identified interest, meaning there is generally no less intrusive means reasonably available to achieve the same purpose. A merely useful or convenient purpose does not typically satisfy necessity.
Balancing test and reasonable expectations
The interest of the controller or third party must not be overridden by the data subject's interests or fundamental rights, taking into account the relationship with and reasonable expectations of the data subject at the time the data was collected. Safeguards and mitigating measures can influence the outcome.
Scope limitations
This basis is generally not available to processing carried out by public authorities in the performance of their tasks. It also cannot be used, on its own, for special category data under Article 9, which requires a separate Article 9 condition in addition to an Article 6 basis.

Common questions

Answers to the questions practitioners most commonly ask about Legitimate Interest of a Third Party.

Does relying on a third party's legitimate interest mean I can skip getting consent from data subjects?
No. Legitimate interests (including those of a third party) and consent are distinct legal bases under Article 6, and choosing to rely on legitimate interests is not a way to avoid a consent requirement that genuinely applies. Legitimate interests must be assessed on their own terms, including a balancing exercise against the rights and interests of the data subject. Where special category data is involved, an additional Article 9 condition is also required regardless of the Article 6 basis. Which basis is appropriate depends on the context, and this should be determined before processing begins.
Is a legitimate interest 'of a third party' just the same thing as the controller's own legitimate interest?
Not necessarily. The GDPR text recognises that the legitimate interests pursued may be those of the controller or of a third party, so the interest can belong to someone other than the controller carrying out the processing. However, the existence of a third party's interest does not by itself justify the processing; it still must be a genuine, lawful, and sufficiently articulated interest, and it must survive the balancing test against the data subject's rights and freedoms. Identifying whose interest is being relied on is an important part of documenting the basis correctly.
How should the legitimate interest of a third party be documented?
In most cases this is done through a legitimate interests assessment (sometimes called an LIA), which typically records the interest being pursued, why the processing is necessary to achieve it, and the outcome of the balancing exercise against the data subject's interests, rights, and freedoms. Where the interest belongs to a third party rather than the controller, the assessment should identify that third party and the nature of their interest. The LIA is not a form prescribed in the Regulation text, so its exact structure can vary; the reader should check current guidance from the relevant supervisory authority.
What information should be given to data subjects when relying on a third party's legitimate interest?
Transparency obligations generally require that the legal basis be communicated to data subjects, and where legitimate interests are relied upon, the interests pursued are typically to be identified. Where the interest is that of a third party, that should be reflected in the information provided. The precise content and timing of transparency information depend on the applicable transparency provisions and the circumstances of collection, so the specific wording should be confirmed against the current official text and relevant guidance.
How does the balancing test work when the interest belongs to a third party rather than the controller?
The balancing exercise weighs the legitimate interest being pursued against the interests, rights, and freedoms of the data subject, taking into account their reasonable expectations and the potential impact of the processing. The fact that the interest belongs to a third party does not remove the need for this assessment and can affect how the balance is struck, for example where the data subject may not reasonably anticipate processing for another party's benefit. The outcome is context and risk dependent and should be assessed case by case.
What happens if a data subject objects to processing based on a third party's legitimate interest?
Where processing is based on legitimate interests, data subjects generally have a right to object, and on receiving an objection the controller typically must stop processing unless it can demonstrate compelling legitimate grounds that override the individual's interests, rights, and freedoms, or grounds relating to legal claims. The handling of an objection should be assessed on the specific facts, and the exact scope of the right and any applicable exceptions should be verified against the current text and relevant guidance.

Common misconceptions

A legitimate interest of a third party can justify processing on its own, without further analysis.
Identifying a third party's interest is only the first step. The processing must also be shown to be necessary and must survive the balancing test against the data subject's interests, rights, and freedoms. The existence of an interest does not by itself make processing lawful.
Legitimate interests is a weaker or fallback basis that applies whenever consent is impractical.
It is a distinct Article 6 basis with its own requirements, not a fallback for failed consent. The choice of basis should be made deliberately before processing, and legitimate interests carries its own documentation and balancing obligations rather than being a lower-effort alternative.
The third party's interest always outweighs the individual because a legitimate business need exists.
A legitimate need does not guarantee the balancing test is passed. The outcome depends on the nature of the interest, the necessity of the processing, the data involved, the data subject's reasonable expectations, and any safeguards applied. The assessment is context-dependent and may conclude that the individual's rights prevail.

Best practices

Document a Legitimate Interests Assessment (LIA) before processing, clearly recording the interest, the necessity analysis, and the balancing test, and identifying whether the interest is that of the controller or a specified third party.
Where the interest belongs to a third party, name the third party or category of third parties and articulate their specific interest rather than relying on a vague or generalised assertion.
Test necessity rigorously by considering whether a less intrusive means could achieve the same purpose, and record why the chosen processing is necessary.
Assess the data subject's reasonable expectations at the point of collection and apply proportionate safeguards or mitigating measures to strengthen the balancing outcome.
Confirm the basis is appropriate for the actors and data involved: avoid relying on it for public authority tasks in performance of their functions, and secure a separate Article 9 condition where special category data is in scope.
Provide the required transparency information about reliance on legitimate interests, including the interest pursued, and be prepared to address the data subject's right to object, reviewing the assessment periodically or when circumstances change.