A legitimate interest assessment (LIA) is the written record of the three-part test (purpose, necessity and balancing) you run before relying on legitimate interests under Article 6(1)(f) of the GDPR. The ICO says the UK GDPR does not require one, “But you should do one anyway.” Since 5 February 2026, when Article 6(11) came fully into force, the UK GDPR has listed processing for direct marketing as an example of a possible legitimate interest. For cold email the LIA only counts after a gate: where the UK’s PECR requires consent for the email, the ICO says legitimate interests cannot be your lawful basis.
The mistake is treating the LIA as permission to send. As the ICO puts it, “Legitimate interests can’t legitimise unlawful processing,” so run the gate first, then the three tests.
An LIA records why your use of a contact’s data passes three tests. It cannot overrule a consent rule for the email itself.
Key numbers
| Item | Number |
|---|---|
| Tests in a legitimate interest assessment (purpose, necessity and balancing) | 3 |
| UK GDPR Article 6(11) marketing example, fully in force (for specified purposes from 19 June 2025) | 5 February 2026 |
| Maximum UK GDPR fine for an Article 6 breach (or 4% of an undertaking’s worldwide annual turnover if higher) | £17.5 million |
| Maximum EU GDPR fine for an Article 6 breach (or 4% of an undertaking’s worldwide annual turnover if higher) | EUR 20 million |
| PECR email rule under the same maximum from (Data Protection Act 2018 s.157, via PECR Schedule 1) | 5 February 2026 |
| EU GDPR Article 14 notice, data from another source (and at the latest in your first email) | One month at the latest |
| EDPB Guidelines 1/2024 on legitimate interests (consultation draft; no final version listed on 30 October 2026) | Version 1.0 |
| Court of Justice judgment, C-621/22 (a commercial interest can qualify only if lawful and strictly necessary) | 4 October 2024 |
| ICO sample LIA template (optional; any form that covers all three tests) | Word document |
Read on 29 and 30 October 2026 from the ICO’s legitimate interests and business-to-business marketing guidance, the UK GDPR, PECR and the Data Protection Act 2018 on legislation.gov.uk, the EU GDPR, the ePrivacy Directive and judgment C-621/22 on EUR-Lex, and the EDPB.
What an LIA is, and what the law asks of it
The ICO calls an LIA “a type of light-touch risk assessment.” It “doesn’t have to take any particular form,” although the ICO publishes a sample LIA template in Word, and it must address each part of the three-part test.
Processing without a valid lawful basis infringes Article 6, which Article 83(5) of the UK GDPR fines up to £17.5 million (EUR 20 million under the EU GDPR), or for an undertaking 4% of total worldwide annual turnover in the preceding financial year if higher. Since 5 February 2026 PECR’s email rule carries the same maximum, under section 157 of the Data Protection Act 2018 as applied by PECR Schedule 1.
Run the gate first: does PECR require consent?
In the UK, PECR regulation 22 bans marketing email to “individual subscribers” without their consent, apart from a soft opt-in for contacts whose details you got “in the course of the sale or negotiations for the sale,” for “similar products and services only.” The ICO says that rule “doesn’t apply to corporate subscribers,” such as companies, limited liability partnerships, Scottish partnerships and some government bodies. Sole traders and other types of partnerships are individual subscribers, and if you cannot tell, the ICO says to treat an address as an individual subscriber’s (see our UK cold email laws guide).
| Who you email in the UK | Does PECR require consent? | Legitimate interests as the basis? |
|---|---|---|
| An employee at a company, LLP or Scottish partnership | No | Likely, after the three-part test |
| A sole trader or other partnership, from a soft opt-in | No | Likely, after the three-part test |
| A sole trader or other partnership, no soft opt-in | Yes | No: consent must be the basis |
| Anyone who has objected to direct marketing | Whatever PECR says, stop | No: the objection overrides it |
Sources: the ICO’s business-to-business marketing guidance, which it says “is under review and may be subject to change,” and its legitimate interests guidance, read on 30 October 2026.
In the EU, Article 13 of the ePrivacy Directive requires prior consent for marketing email to subscribers who are natural persons, apart from an exception for your own customers and similar products or services, and leaves other subscribers to each member state. The EDPB’s draft Guidelines 1/2024 (version 1.0, put to public consultation in October 2024 and not final as of 30 October 2026) say that where that consent is required, the processing “may not be based on Article 6(1)(f) GDPR.” In the Netherlands the consent rule covers businesses too, and in Finland the Data Protection Ombudsman treats an address like [email protected] as belonging to a natural person.
We wrote an LIA, so we can email any business contact without consent.
Sole traders and some partnerships are individual subscribers under PECR: email to them needs consent or a soft opt-in.
“If PECR require consent, you must not use legitimate interests as your lawful basis for using personal information for that purpose.”
For emails to business contacts, the ICO marks legitimate interests as likely to be appropriate, after the three-part test.
Test 1: the purpose test
The ICO’s purpose questions include “Why do you want to use the personal information?” and “Are you complying with other relevant laws?” Article 6(11) of the UK GDPR, fully in force since 5 February 2026 (for specified purposes from 19 June 2025), lists processing “necessary for the purposes of direct marketing” as an example of what “may” be a legitimate interest, but the ICO says the law “doesn’t say that direct marketing always constitutes a legitimate interest.”
On 4 October 2024 the EU Court of Justice ruled in C-621/22 that disclosing members’ data to sponsors for payment, to serve a commercial interest, can be necessary for a legitimate interest only if the interest is lawful, the processing strictly necessary and the members’ interests do not override it. A hypothetical purpose line might read: offer our bookkeeping software to finance managers at UK companies, to win new customers.
Test 2: the necessity test
The ICO asks: “Can you achieve your purpose without using the personal information, or by using less information?” The Court of Justice sets the bar at interests that “cannot reasonably be achieved just as effectively by other means less restrictive” of people’s rights. My answer would list the four fields a cold email needs (name, work email, job title and company) and nothing else.
Test 3: the balancing test
The ICO says you “must include people’s reasonable expectations,” and asks whether the data is about people “in their personal or professional capacity.” Business contacts “are more likely to reasonably expect you to use their personal information in a business context,” it says, though you should still consider the likely impact. For a bought or scraped list, two of its questions matter most: what the source told people about reuse by third parties, and how long ago the data was collected.
The ICO names an opt-out as a safeguard, but warns: “Failure to opt out doesn’t demonstrate consent.” Under Article 14 of the EU GDPR you must tell people, among other things, the legitimate interest you rely on and where their data came from, within a reasonable period and at the latest within one month of getting it, and, if you email them, at the latest in that first email. Article 21 requires the right to object to be “explicitly brought to the attention” of the person by that first email, “clearly and separately from any other information.” Once someone objects, the data “shall no longer be processed” for direct marketing; the EDPB’s draft calls that right “unconditional.”
A fill-in LIA for a B2B cold email list
I would write the LIA in four entries:
Sort every address by subscriber type
Mark each contact as corporate (such as a company, LLP or Scottish partnership) or individual (such as a sole trader or other partnership), and treat unclear ones as individual. For EU recipients, check the country’s own rule first in our cold email laws by country table.
Write the purpose and necessity in two lines
One line for the interest and the benefit, one for the four fields you keep and why you need no more. Date it and name the person who signed it off.
Record the source and the balance
Note where the list came from, what that source told people and when the data was collected, then the likely impact on the people on it and your conclusion that their interests do not override yours. Put anyone who objects on a suppression list rather than deleting them, as the ICO suggests, so new lists can be screened against it.
Put the safeguards in the first email
Say who you are, the legitimate interest you rely on, where you got the address and how to object, set apart from the pitch. Screen every send from every mailbox against one suppression list (our email hosting cost guide prices mailboxes per user).
My team has delivered 500+ projects across 30 countries. The sending domains and mailboxes in the email infrastructure we build come with one-click unsubscribe headers and one suppression list across every inbox.
The bottom line
Gate first, then three tests, then a dated record. Where PECR requires consent for the address, no LIA covers it. See also our guide to GDPR and cold email. I am not a lawyer. This is general information, not legal advice.