Legitimate interest, as defined under the GDPR, constitutes a legal basis for processing personal data without requiring the explicit consent of individuals, but only in specific situations defined by the CNIL (French Data Protection Authority). To justify the use of legitimate interest, it is essential to refer to Article 6(1)(f) of the GDPR. The CNIL has issued guidelines to clarify the interpretation of this provision. In accordance with the CNIL’s recommendations, an impact assessment on privacy (IAP) must be carried out by the organization to evaluate whether its interests override the rights and freedoms of the data subjects. This assessment process, which is mandatory, must be submitted to the CNIL for review.

There are two main legal bases for the collection and processing of data: legitimate interest and consent. Legitimate interest represents one of these legal bases, while the other is based on the explicit consent of users regarding the processing of their personal data. It is essential to note that the Data Protection Impact Assessment (DPIA) is an integral component of this process.