Skip to main content
Privacy Track
Category: Lawful Basis for Processing

Public Interest

Also known as: public interest law
Simply put

Public interest broadly refers to the general welfare or well-being of the public and society as a whole. In a legal context, it is often associated with public interest law, which describes law-related work performed on behalf of individuals, groups, or causes that would otherwise lack effective representation. The precise meaning varies by context and is not defined by a single universal standard.

Formal definition

In social science and economics, public interest is generally described as the welfare or well-being of the general public and society. It is also commonly invoked as a legal concept, notably through public interest law, which refers to work advocating for the rights and interests of individuals, organizations, or causes that would otherwise go unrepresented; some jurisdictions and commentators treat it as encompassing the general welfare of the public that warrants recognition and protection. The evidence provided does not establish a single authoritative or statutory definition, and the concept's scope typically depends on the applicable legal framework and context. Note: this definition draws on general legal and social-science sources rather than the text of the GDPR; readers should not assume it maps directly onto the GDPR's 'public task' or 'public interest' provisions without verifying against the relevant Regulation text and guidance.

Why it matters

Public interest is a foundational but deliberately open-textured concept that appears across legal, social-science, and economic contexts. Because it broadly denotes the welfare or well-being of the general public and society, it functions as a touchstone for justifying actions, protections, and advocacy that serve people or causes lacking effective representation. Its significance lies partly in this flexibility: it allows courts, legislators, and practitioners to weigh collective welfare against individual or commercial interests, but that same flexibility means its scope typically depends on the applicable legal framework rather than a single universal standard.

For privacy and data protection professionals, the concept requires particular care. The GDPR uses related language, including provisions concerning a 'public task' and processing in the 'public interest,' but the general legal and social-science understanding of public interest described here does not map automatically onto those Regulation-specific provisions. Treating the two as interchangeable can lead to misidentifying the correct legal basis or condition for processing. The evidence available describes the general concept and public interest law, not the GDPR's specific mechanics.

Because no single authoritative or statutory definition is established by the evidence, and because interpretations can differ between jurisdictions, commentators, and regulators, practitioners should treat any invocation of public interest as context-dependent. Where the concept is being relied upon in a compliance context, the boundary of its meaning and its evidentiary support should be verified against the relevant legal text and current guidance rather than assumed.

Who it's relevant to

Data protection officers and compliance leads
DPOs and compliance leads may encounter public interest language when assessing legal bases or conditions for processing. They should take care to distinguish the general concept described here from the GDPR's specific 'public task' and 'public interest' provisions, and should verify the correct basis against the relevant Regulation text and guidance rather than relying on the broad social-science meaning.
Lawyers and legal practitioners
Practitioners working on advocacy, litigation, or public interest law engage directly with the concept when representing individuals, organizations, or causes that would otherwise lack effective representation. Because there is no single authoritative or statutory definition in the evidence, they should ground any reliance on public interest in the applicable jurisdiction's framework.
Public interest law firms and public-service organizations
Public interest law firms, which may be private, for-profit associations of lawyers distinguished by the causes they serve, and related public-service bodies operationalize the concept in their day-to-day work. Their framing of what constitutes the public interest typically reflects their mission and the legal context in which they operate.
Policymakers and regulators
Those drafting or interpreting rules may invoke public interest to justify measures affecting the general welfare of the public. Given that interpretations can diverge between jurisdictions and commentators, they should be explicit about the framework and evidentiary basis on which any public interest determination rests.

Inside Public Interest

Public task legal basis (Article 6(1)(e))
Processing of personal data may be lawful where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This basis is distinct from consent and from legitimate interests, and typically applies to public authorities or bodies exercising functions of a public character.
Basis in law requirement
Reliance on the public interest task generally requires that the task be laid down in EU or member state law. The specific content and scope of such laws can vary by member state through derogations and national implementing legislation, so the position is not uniform across the EU.
Necessity assessment
The processing must be necessary for the public interest task, meaning there should be no less intrusive reasonable means of achieving the objective. Necessity is assessed on the facts rather than assumed.
Interaction with special category data
Where special category data under Article 9 is processed, an additional Article 9 condition is required alongside the Article 6 public task basis. Reasons of substantial public interest can, subject to assessment and an appropriate legal basis, form one such condition, but this is separate from the Article 6(1)(e) basis itself.
EU and UK GDPR context
The public task basis exists in both the EU GDPR and the UK GDPR, though the underlying enabling laws and their interpretation may differ between the EU, individual member states, and the UK. Practitioners should identify which regime applies to a given processing activity.

Common questions

Answers to the questions practitioners most commonly ask about Public Interest.

Is 'public interest' a legal basis available to any organization that believes its processing benefits society?
No. The Article 6(1)(e) basis, often referred to as 'public task', is not a general licence for any processing an organization considers beneficial. It typically applies to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority, and it generally requires a foundation in EU or member state law. A private commercial benefit, or a subjective belief that processing is socially useful, is not usually sufficient. Organizations without a relevant legal foundation more often rely on other Article 6 bases, such as legitimate interests, subject to assessment.
Does relying on the public interest basis mean consent is never needed?
Not necessarily. Consent and public task are distinct Article 6 bases, and identifying one lawful basis for general personal data does not resolve every requirement. Where special category data under Article 9 is involved, an additional Article 9 condition is required on top of the Article 6 basis. Separately, certain activities such as some electronic marketing may be governed by other rules (for example, ePrivacy requirements) that can call for consent independently of the Article 6 analysis. The position can also vary with member state derogations, so this should be assessed case by case.
How does an organization establish the legal foundation needed to rely on the public task basis?
In most cases the task or authority is expected to be laid down in EU or member state law, though that law need not always be a specific statutory provision naming the exact processing. Practically, an organization should identify and document the source of its public interest task or official authority, confirm that the processing is necessary for that task, and record this in its records of processing. Because the required specificity and the role of national implementing law can vary between member states, organizations should verify the position under the applicable national law rather than assume a single EU-wide standard.
What documentation should support reliance on the public interest basis?
Organizations typically document the identified lawful basis, the underlying legal foundation for the task or authority, a necessity assessment showing the processing is required to perform the task, and how this is reflected in privacy information provided to individuals. Where special category data is processed, the additional Article 9 condition and any relevant national law condition should also be recorded. Depending on the risk profile, a Data Protection Impact Assessment under Article 35 may be appropriate, and this should be documented separately from the lawful basis analysis.
How does the choice of public interest as a basis affect data subject rights?
The available rights can differ depending on the lawful basis. Where processing relies on the public task basis, the right to erasure and the right to data portability are generally more limited than under some other bases, while the right to object applies in a particular form that can require the controller to demonstrate compelling grounds. Because the interaction between basis and rights is technical and subject to specific conditions, organizations should map each right against the chosen basis and verify the current position against the applicable text and regulator guidance.
Can the public interest basis be used to justify onward transfers of personal data outside the EEA?
Identifying public task as the Article 6 basis for processing is a separate question from the lawfulness of any international transfer. Restricted transfers generally require an appropriate transfer mechanism, such as an adequacy decision, standard contractual clauses, or another recognized tool, potentially with supplementary measures depending on the circumstances. There are also specific derogations that may reference important reasons of public interest, but these are typically construed narrowly and are not a routine transfer solution. Because transfer tools and adequacy decisions evolve, the current position should be verified against the official text and applicable guidance.

Common misconceptions

Any organisation acting for the general good can rely on the public interest basis.
The public task basis under Article 6(1)(e) is generally tied to a task laid down in EU or member state law and typically applies to public authorities or bodies exercising official authority. Private organisations pursuing broadly beneficial aims usually rely on a different Article 6 basis, such as legitimate interests, subject to assessment.
If processing serves the public interest, consent is not needed and no further conditions apply.
While consent is not the applicable basis here, reliance on the public task basis still requires necessity and a basis in law. Where special category data is involved, an additional Article 9 condition must also be satisfied.
The public interest basis applies identically across the EU and the UK.
The basis derives from the GDPR text, but the specific enabling laws differ between member states and the UK, and member state derogations can vary the position. The applicable regime and underlying national law should be verified in each case.

Best practices

Confirm that a specific basis in EU or member state law (or UK law where applicable) underpins the public interest task before relying on Article 6(1)(e), and document the reference.
Carry out and record a necessity assessment showing that the processing is required to perform the task and that no less intrusive reasonable alternative exists.
Identify a separate Article 9 condition, such as substantial public interest with an appropriate legal basis, whenever special category data is processed, and document it distinctly from the Article 6 basis.
Verify which regime applies (EU GDPR, UK GDPR, or relevant national implementing law) and account for member state derogations that may vary the position.
Avoid defaulting to consent or legitimate interests without analysis; select the Article 6 basis that most accurately reflects the controller's function and legal authority.
Review the applicable enabling laws and guidance periodically, as national interpretations and regulator positions may evolve, and verify against the current official text.