TRUST CENTRE · POLICY 05
Legitimate Interests Framework
Framework for assessing whether legitimate interests can support relevant B2B professional-data processing.
1. Purpose test
Before relying on legitimate interests, Sentra should define the specific commercial purpose and identify whose legitimate interest is being pursued. A vague interest in ‘marketing’ is not enough; the workflow should have a defined audience, proposition and professional relevance.
2. Necessity test
The processing should be reasonably necessary for the defined purpose. Sentra should consider whether the same outcome could reasonably be achieved with materially less personal data or a less intrusive method.
3. Balancing test
- Nature of the data: professional/business information is generally less intrusive than private or sensitive information, but still requires protection.
- Reasonable expectations: consider the individual’s professional role, relationship to the company and context in which the data is available.
- Impact: consider frequency, channel, transparency, accuracy risk and consequences of an incorrect identity match.
- Safeguards: use data minimisation, confidence gates, suppression, objection handling, source records and channel controls.
4. Identity resolution
Where an individual must be matched to a company or officer record, Sentra should use corroborating evidence appropriate to the risk. Name similarity alone should not be treated as sufficient where ambiguity is material. Missing reference to a newly incorporated company on a professional profile is not automatically contradictory because public profiles may lag behind current company records.
5. Outcome and review
An LIA should record the purpose, necessity, balancing factors, safeguards and conclusion. It should be reviewed if the audience, data sources, channel, proposition, scale or other material aspect of the processing changes.
6. Relationship with PECR
A legitimate-interests assessment under UK GDPR does not remove the need to consider PECR or other channel-specific rules. The lawful basis for processing and the rules governing a particular communication channel are related but distinct assessments.