Category: Lawful Basis for Processing

Reasonable Expectations of Data Subjects

Also known as: Reasonable Expectations, Reasonable Expectations Test

Simply put

Reasonable expectations of data subjects refers to what individuals would sensibly anticipate happening to their personal data, given how and why it was collected. When an organisation relies on legitimate interests to process personal data, it should consider whether people would reasonably expect that use. Meeting or defeating those expectations is an important factor, but it does not by itself decide whether the processing is lawful.

Formal definition

In the context of the legitimate interests lawful basis, the concept of a data subject's reasonable expectations forms part of the balancing exercise weighing the controller's (or third party's) interests against the interests, rights, and freedoms of the individual. Regulatory guidance indicates that a controller must consider what the data subject may reasonably expect at the time and in the context of the collection of their personal data. This assessment is one factor within the balancing test and is not automatically determinative of the outcome; the ICO notes that merely warning a person that their information will be used in a particular way does not, on its own, establish that the processing is within their reasonable expectations or is otherwise lawful. Guidance also emphasises that any legitimate interest pursued must be lawful, clear, real and present, and that the processing must be necessary for that interest. This term derives principally from regulatory guidance interpreting the legitimate interests basis rather than from a discrete definitional provision in the Regulation text; readers should verify the precise application against current ICO and EDPB guidance and the applicable GDPR or UK GDPR provisions, as the assessment is context-dependent and subject to case-by-case judgment.

Why it matters

The reasonable expectations concept sits at the heart of the legitimate interests balancing exercise, which is one of the most commonly relied-upon yet most contested lawful bases under Article 6 of the GDPR and UK GDPR. When an organisation processes personal data on the basis of legitimate interests rather than consent, it cannot simply assert that its own commercial or operational interest justifies the processing. It must weigh that interest against the interests, rights, and freedoms of the individual, and what people would reasonably anticipate happening to their data is a significant part of that weighing. Getting this wrong risks the entire legal basis falling away, which can render the processing unlawful.

A particular pitfall is the assumption that disclosure equals lawfulness. The ICO cautions that merely warning a person that their information will be used in a particular way does not, on its own, place that use within their reasonable expectations or otherwise make the processing lawful. In other words, burying a novel or intrusive use in a privacy notice does not automatically satisfy the test. Organisations that treat transparency as a substitute for a genuine assessment of expectations may find their legitimate interests analysis is not defensible if challenged by a regulator or data subject.

Because this concept derives principally from regulatory guidance interpreting the legitimate interests basis rather than from a discrete definitional provision in the Regulation text, its application is context-dependent and subject to case-by-case judgment. Readers should verify the precise position against current ICO and EDPB guidance and note that regulators may emphasise different factors. The assessment is generally most robust where the processing is closely aligned with the context in which the data was originally collected, and it becomes more difficult to sustain where the intended use is unexpected, intrusive, or far removed from that original context.

Who it's relevant to

Data Protection Officers and Privacy Leads

DPOs and privacy leads are typically responsible for reviewing and challenging legitimate interests assessments before processing begins. Understanding that reasonable expectations are a factor within, rather than a shortcut through, the balancing test helps them avoid over-reliance on privacy notices and ensures the assessment reflects the context in which data was collected.

Privacy and Compliance Lawyers

Lawyers advising on lawful basis need to distinguish reasonable expectations from a standalone legal requirement. Because the concept derives principally from regulatory guidance rather than a discrete provision in the Regulation text, advice should reference current ICO and EDPB guidance and flag that application is case-by-case and may vary between regulators.

Product and Engineering Teams

Teams designing new features or data uses should consider, at the point of collection, whether individuals would sensibly anticipate the intended processing. Novel or intrusive uses that diverge from the original collection context are harder to sustain under legitimate interests, so surfacing this early can shape design choices and reduce downstream compliance risk.

Marketing and Analytics Functions

Because legitimate interests can, subject to assessment, support processing without explicit consent in some circumstances, marketing and analytics teams may seek to rely on it. They should understand that simply informing individuals of a use does not place it within their reasonable expectations, and that some processing may nonetheless require consent depending on the context and applicable rules.

Inside Reasonable Expectations of Data Subjects

Contextual assessment of the relationship

The reasonable expectations concept turns on what a data subject would reasonably anticipate given the nature of their relationship with the controller and the circumstances in which the personal data was collected. It is a contextual, fact-specific inquiry rather than a fixed rule.

Relevance to the legitimate interests balancing test

Reasonable expectations feature in the balancing exercise associated with the legitimate interests legal basis under Article 6(1)(f), where the interests of the controller are weighed against the interests, rights, and freedoms of the data subject. Recital 47 refers to whether a data subject can reasonably expect processing at the time of collection; recitals are interpretive aids rather than binding operative provisions, and readers should verify the exact wording against the current official text.

Relevance to compatibility of further processing

The concept is also relevant when assessing whether processing for a new purpose is compatible with the purpose for which data was originally collected. What the data subject would reasonably expect informs, but does not by itself determine, that compatibility analysis.

Objective, not purely subjective, standard

The reference point is generally what a reasonable data subject in that position would expect, informed by the information provided and the surrounding circumstances, rather than the actual subjective belief of a particular individual.

Influence of transparency and prior information

The information given to data subjects, including privacy notices and the point-of-collection context, shapes what can reasonably be expected. Clear disclosure can broaden the range of processing that falls within reasonable expectations, though disclosure alone does not automatically make processing lawful.

Common questions

Answers to the questions practitioners most commonly ask about Reasonable Expectations of Data Subjects.

Are reasonable expectations of data subjects a standalone legal basis for processing under the GDPR?

No. Reasonable expectations are not one of the six Article 6 legal bases and cannot by themselves make processing lawful. They function primarily as a factor within the legitimate interests assessment (the balancing test), where Recital 47 indicates that whether a data subject can reasonably expect processing at the time and in the context of collection is relevant to weighing their interests against the controller's. You still need to identify and rely on a valid Article 6 basis, and, for Article 9 special category data, an additional condition.

If processing falls within a data subject's reasonable expectations, does that mean consent is not needed and the processing is automatically compliant?

Not necessarily. Reasonable expectations inform the balancing exercise but do not guarantee compliance. Meeting expectations does not remove other obligations such as transparency, purpose limitation, data minimisation, and, where applicable, a lawful basis other than legitimate interests. Consent may still be required in specific contexts (for example certain uses involving special category data or where other rules such as ePrivacy provisions apply). Whether expectations are met is a context-dependent judgment, not a compliance certification.

How can a controller assess what data subjects reasonably expect in a given context?

Assessment is generally contextual and evidence-based rather than assumed. Controllers typically consider the relationship with the data subject, the nature of the service, what was communicated at the point of collection, the sensitivity of the data, and how closely a new purpose relates to the original one. Some organisations use user research, surveys, or documented reasoning to support their view. Because this is a judgment call subject to challenge, recording the basis for the assessment is advisable, and regulator guidance on the point should be checked.

How should reasonable expectations be documented within a legitimate interests assessment?

In most cases the analysis of reasonable expectations is captured as part of the balancing stage of a legitimate interests assessment (often documented as an LIA). Controllers typically record what information was given to data subjects at collection, the context of the relationship, why the processing would or would not be anticipated, and any safeguards that reduce impact. The documentation should show the reasoning rather than a conclusory statement, so it can be revisited if circumstances or purposes change.

What role does the privacy notice play in shaping reasonable expectations?

Transparency information provided at or before collection generally helps shape what a data subject can reasonably expect, but disclosure alone does not automatically make any processing expected. Burying an unusual or intrusive purpose in a lengthy notice may not create a reasonable expectation of it. Clear, accessible, and specific information about purposes tends to support the position that processing is within expectations, while surprising or unrelated uses may fall outside them regardless of what a notice states.

How do reasonable expectations bear on using personal data for a new or secondary purpose?

Where a controller considers further processing for a purpose beyond the original one, whether that purpose is within the data subject's reasonable expectations is generally relevant, including as part of a compatibility assessment. Factors typically include the link between the original and new purpose, the context of collection, the nature of the data, and possible consequences for the individual. A closely related purpose is more likely to be expected than an unrelated one, but this is a case-by-case evaluation and should be assessed against current guidance.

Common misconceptions

Reasonable expectations is a standalone legal basis for processing.

It is not a legal basis under Article 6. It is a factor that feeds into other assessments, most notably the legitimate interests balancing test and the compatibility-of-purpose analysis. A valid Article 6 basis is still required, and special category data would additionally need an Article 9 condition.

If a controller discloses a processing activity in a privacy notice, it automatically falls within the data subject's reasonable expectations and is therefore lawful.

Disclosure is relevant but not decisive. Reasonable expectations are assessed in context, and even where an activity is disclosed the overall lawfulness still depends on the applicable legal basis and, where relevant, the outcome of a balancing test. Compliance remains context and risk dependent.

Reasonable expectations reflect only the individual data subject's actual, subjective view.

The assessment is generally framed around what a reasonable data subject in the relevant position would expect given the circumstances of collection, rather than the particular subjective expectation of any one individual.

Best practices

Document, at the point of collection, the purposes and context of processing so that the range of what data subjects can reasonably expect is clearly evidenced.

When relying on legitimate interests under Article 6(1)(f), record the balancing assessment and explicitly address whether the processing sits within data subjects' reasonable expectations.

Before repurposing personal data, carry out and document a compatibility assessment that considers reasonable expectations alongside the other relevant factors.

Ensure privacy notices and collection-point information are clear and specific, recognising that transparency shapes but does not by itself establish reasonable expectations or lawfulness.

Reassess reasonable expectations when the relationship, technology, or processing purposes change, since expectations are contextual and can shift over time.

Check current regulatory guidance and the applicable text (including UK GDPR or national implementing law where relevant) rather than relying on a single interpretation, as regulators may diverge on how this factor is weighed.