The Information Commissioner's Office (ICO) has published detailed guidance on legitimate interests as a basis for processing personal data. The guidance sits alongside the ICO's Guide to the GDPR and is intended to help organisations decide when to rely on legitimate interests as a basis for processing personal data.

Although the concept of "legitimate interests" as a basis for processing is not new, the GDPR has introduced some changes, such as enabling organisations to consider the legitimate interests of any third party and requiring organisations to document their legitimate interest decisions to demonstrate compliance with the GDPR.