Article

When Can We Rely on Legitimate Interests?

UK Information Commissioner's Office (ICO) Free Intermediate

The UK regulator's own walkthrough of the three-part test (purpose, necessity, balancing) that decides whether you can cold email someone under GDPR without asking first. It is written for the business doing the emailing, so it is more usable than most GDPR explainers you will find.

• Business contacts are more likely to reasonably expect professional outreach than consumers.
• You still need to pass a purpose, necessity, and balancing test, not just claim legitimate interest.
• The recipient's right to object overrides your legitimate interest the moment they raise it.