EDPB Opinion 28/2024, para 66: the legitimate interest test must be assessed and documented (EDPB Opinion 28/2024, adopted 17 December 2024, para 66)

The EU regulators will look for a written assessment covering the interest, the necessity and the balance. A holder should keep one for each lot, ready to show a regulator or a buyer.

Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text

In the source's own words

“SAs should verify that controllers have carefully assessed and documented whether the three following cumulative conditions are met: (i) the pursuit of a legitimate interest by the controller or by a third party; (ii) the processing is necessary to pursue the legitimate interest; and (iii) the legitimate interest is not overridden by the interests or fundamental rights and freedoms of the data subjects”

Where it was read

EDPB Opinion 28/2024, para 66: the legitimate interest test must be assessed and documented, European Union, checked 18 Oct 2026
Everything read from this source (7)