BfDI Welcomes EDPB GDPR Guidelines on Legitimate Interest

Detected March 17th, 2026

Summary

The European Data Protection Board (EDPB) has released draft guidelines on the processing of personal data based on legitimate interest under GDPR. The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) welcomes the initiative to provide greater legal certainty. The guidelines are now open for public consultation.

View original document View source feed page

What changed

The European Data Protection Board (EDPB) has issued draft guidelines clarifying the conditions under which controllers can process personal data based on legitimate interest, a key legal basis under the GDPR. The guidelines aim to provide greater legal certainty and consistency, emphasizing that legitimate interest should not be treated as a last resort or overly extended. The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) has welcomed these guidelines.

Regulated entities, particularly those relying on legitimate interest for data processing, should review these draft guidelines. The EDPB is conducting a public consultation, and interested parties should prepare to submit comments by the deadline to influence the final guidance. Failure to comply with the final GDPR requirements regarding legitimate interest could lead to enforcement actions and penalties.

What to do next

Review draft EDPB guidelines on legitimate interest
Prepare and submit comments during the public consultation period

Source document (simplified)

Press release 12/2024

BfDI welcomes EDPB guidelines on legitimate interest

The Federal Commissioner for Data Protection and Freedom of Information (BfDI), Prof. Dr. Louisa Specht-Riemenschneider, emphasises the importance of the new guidelines of the European Data Protection Board (EDPB) on the so-called legitimate interest:

Source: ©Andrey Kuzmin - stock.adobe.com

The definition of 'legitimate interest' has been a cause for discussion since the introduction of the General Data Protection Regulation. Especially for the relationship between industry and private individuals, it is crucial when data may be processed on this basis. It is therefore very good that the European Data Protection Board has presented its guidelines on this subject. I hope that this will provide more legal certainty for citizens, but also for businesses. Prof. Dr. Louisa Specht-Riemenschneider
The guidelines focus on the conditions that controllers must meet if they wish to process personal data in order to ensure legitimate interests. In practice, this legal basis is very important. However, the corresponding article of the General Data Protection Regulation leaves a large margin for interpretation. The EDPB now ensures greater clarity and consistency in this respect.

The guidelines make it clear that data processing on the basis of legitimate interest should not only be considered as a "last resort" for processing projects for which other legal bases do not apply. Nor should the legal basis be overly extended on the grounds that it is supposedly less restrictive than other legal bases.

The EDPB will conduct a public consultation on the guidelines.

The guidelines will soon be available on the EDPB website.