Glossary
Legitimate interests
A GDPR lawful basis (Article 6(1)(f)) for processing necessary for legitimate interests, unless overridden by the rights of the data subject.
Legitimate interests is one of the six lawful bases in Article 6(1) GDPR. Under Article 6(1)(f), processing is lawful where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child. Public authorities cannot rely on it for processing carried out in the performance of their tasks. In practice, relying on it involves identifying the interest, showing the processing is necessary, and balancing it against the impact on individuals.
This basis matters to security teams because Recital 49 states that processing strictly necessary and proportionate for ensuring network and information security constitutes a legitimate interest of the controller. That covers much of what a SOC does: collecting logs, running intrusion detection, analysing malware and investigating incidents.
The recital does not give unlimited licence. The words "strictly necessary and proportionate" require data minimisation, defined retention periods, restricted access to logs and transparency towards users and employees. Intrusive tools such as DLP or TLS inspection need particular care, and documenting the balancing test is part of accountability. See our guide to security logging and monitoring.