20 July 2026 · Last reviewed 20 July 2026

Legitimate Interest Assessment Template for Email Marketing (UK)

A Legitimate Interest Assessment (LIA) is the document you complete before relying on legitimate interest as your UK GDPR lawful basis for processing personal data. For email marketing, that typically means before emailing business contacts, before postal marketing campaigns, or before any processing activity where you are not relying on consent.

This article provides a structured template for completing an LIA and explains what the ICO expects in each section, based on its legitimate interests guidance.

Before you start: what an LIA is not

An LIA is not a legal formality you complete once and file away. It is an analytical document that records your reasoning at the time you decided to rely on legitimate interest. The ICO expects you to complete it before the processing starts — because the assessment is what tells you whether legitimate interest applies at all.

An LIA is also not a substitute for meeting your PECR obligations. For email marketing to individual subscribers, you still need PECR consent or soft opt-in regardless of your GDPR lawful basis. See our full guide to legitimate interest for email marketing for why the two laws stack rather than substitute.

The three-part test

The ICO breaks legitimate interest into three sequential tests. You must pass all three.

Part 1: Purpose test — is there a legitimate interest?

Write down the specific processing activity and the specific purpose it serves. The purpose must be genuine and not prohibited by law.

Template prompts:

  • What personal data are we processing?
  • What are we doing with it?
  • What business or social purpose does this serve?
  • Is this purpose genuine, or a rationalisation of an activity we want to do anyway?
  • Is this purpose one that the law otherwise prohibits or restricts?

Worked example:

Processing: Using business email addresses of named contacts at SME organisations to send a monthly email newsletter about UK data protection compliance updates.

Purpose: Developing awareness of our services among organisations that handle personal data and would benefit from compliance support. Communicating relevant regulatory updates to recipients who operate in regulated sectors.

Assessment: This is a genuine commercial interest (lead generation and brand awareness for a compliance services business). It is not prohibited — the DUAA 2025 Section 70 inserted direct marketing as an example of a legitimate interest under Article 6(1)(f). Part 1: Pass.

Part 2: Necessity test — is processing necessary?

You must show the processing is necessary for the purpose — meaning you cannot achieve the same result in a way that is less intrusive or involves less personal data.

Template prompts:

  • Is processing this personal data genuinely necessary to achieve the stated purpose?
  • Could we achieve the same result without processing personal data at all, or by processing less data?
  • Could we achieve the same result by processing data in a less intrusive way?
  • Are we processing more data than we need?

Worked example:

Assessment: To send a compliance newsletter to named business contacts, we must hold their name and business email address. We cannot deliver the newsletter without this data. Using pseudonymised or aggregated data would not allow delivery. We are not collecting home addresses, phone numbers, or financial data — only name and business email necessary for delivery.

Part 2: Pass.

Part 3: Balancing test — do individual interests override ours?

This is the most substantive part of the LIA. You weigh your interest against the individual's reasonable expectations and the potential impact on them. If the individual's interests override yours, legitimate interest does not apply.

Template prompts:

  • What is the nature of the personal data? (ordinary/special category?)
  • What would the individual reasonably expect?
  • What is the impact of the processing on the individual?
  • What is the nature of our relationship with the individual?
  • Are there any safeguards that reduce the impact?
  • Does any imbalance of power affect the analysis?

Worked example:

Nature of data: Business email addresses of named contacts at their employer. This is not special category data. It is not highly sensitive personal data — it is data the contact shares in a professional capacity.

Reasonable expectations: Business contacts in regulated sectors (law, HR, finance, healthcare) would reasonably expect to receive relevant professional communications. They have shared their work contact details in a professional context and operate in environments where regulatory updates have practical significance.

Impact on the individual: Receiving a monthly email that is relevant to their professional sector. They can opt out in each message. There is no financial, reputational, or physical impact. This is low-risk processing.

Our relationship: These are professionals who have had prior contact with our organisation (attended a webinar, downloaded guidance, connected at an industry event) or who work in relevant sectors and whose contact details are in professional directories.

Safeguards: Every message includes an opt-out mechanism. Opt-outs are processed promptly and are permanent. We do not re-add contacts who have opted out. We review the list annually to remove contacts where the professional relationship has ended.

Conclusion: The individual's interest in not receiving an occasional, relevant, easily-unsubscribable professional email does not override our genuine commercial interest. The processing is not intrusive, the data is not sensitive, the impact is low, and safeguards are in place.

Part 3: Pass.

LIA summary record

After completing the three-part test, record the conclusion in a single summary:

Field Content
Processing activity Monthly compliance newsletter to named business contacts
Controller [Organisation name]
Date completed [Date]
Completed by [Name, role]
Part 1 (purpose) PASS — genuine commercial interest in lead generation and brand awareness
Part 2 (necessity) PASS — name and business email are the minimum data required
Part 3 (balancing) PASS — low-impact, professional context, easily-unsubscribable
Overall conclusion Legitimate interest applies as lawful basis under Article 6(1)(f)
Review date [Date — recommended annually or when processing changes materially]
PECR position Corporate subscribers: no additional PECR consent required. Individual subscribers: PECR consent or soft opt-in required separately.

What the ICO looks for

If the ICO investigates, the LIA needs to show genuine analysis rather than a box-ticking exercise. Assessments that fail ICO scrutiny typically show these patterns:

Too vague on the interest. "We have a legitimate interest in marketing our services" is not specific enough. The interest must be tied to a concrete business or social purpose, described at the level of the specific processing activity.

Skipped the balancing test. The balancing test is the hardest part, and the most commonly omitted. An LIA that says "we pass all three tests" but provides only a paragraph on purpose and nothing on the individual's perspective will not satisfy the ICO.

Completed after the fact. The LIA records your reasoning at the time of the decision. If you complete it weeks or months after you started processing, it looks like rationalisation — not assessment.

Not reviewed when circumstances change. If your list grew significantly, you changed your use of the data, or regulatory requirements changed (as they did with the DUAA 2025), the LIA should be reviewed. A dated, unreviewed LIA from 2020 is not a current assessment.

The ICO's LIA template

The ICO publishes its own guidance with templates: How do we apply legitimate interests in practice? This can be used as an alternative to the template above, or the two can be used together — the ICO template is structured slightly differently but covers the same three-part test.

Related resources

This article is for informational purposes only and does not constitute legal advice. For guidance specific to your organisation, consult a qualified legal professional or data protection officer. Legislative references verified against legislation.gov.uk and ICO guidance as at July 2026.