The Legitimate Interests Test: A Balancing Guide for KVKK and GDPR

Legitimate interest is a frequently used ground for processing personal data under both KVKK and GDPR, but it is prone to misinterpretation. Saying “the company has a commercial interest” does not, by itself, make personal data processing lawful.

A legitimate interest assessment must examine together the legitimacy of the interest, the necessity of processing and the balance with the data subject’s fundamental rights and freedoms.

Legitimate Interest under KVKK

Under Article 5(2)(f) of Law No. 6698, personal data may be processed without explicit consent where processing is necessary for the data controller’s legitimate interests, provided that it does not harm the data subject’s fundamental rights and freedoms.

Is Every Commercial Interest a Legitimate Interest?

No.

The current guidance of the Turkish Personal Data Protection Authority states that a legitimate interest:

must belong to the data controller,
must be current and legitimate,
must be balanced against the data subject’s fundamental rights and freedoms.

These requirements apply together.

The Two-Stage Balancing Test under KVKK

The institution's current guide includes a two-step assessment approach.

Stage 1: Is There legitimate interest?

First, it is determined whether the data controller has a real and existing legitimate interest.

Stage 2: Balance with Rights and Freedoms

The possible impact on the fundamental rights and freedoms of the person concerned is assessed.

The Necessity Test

If the legitimate purpose can be achieved without processing personal data or through a less intrusive method, the proposed processing may not be considered “necessary”.

For example, continuous audio recording needs separate justification where video recording is sufficient for security.

Reasonable Expectation

Whether the data subject could reasonably expect their data to be processed in this way within the specific relationship is an important part of the balancing exercise.

Data Minimization

Just because it's in legitimate interest doesn't mean that the company can process as much data as it wants.

Processing must be:

related to the purpose,
limited,
proportionate.

These limits must be respected.

What is LIA?

A Legitimate Interest Assessment (LIA) is a practical method for documenting the legitimate interest assessment, particularly under GDPR.

The KVKK legislation does not regulate a mandatory standard form under the name "LIA". However, documenting legitimate interest and balance analysis in writing is a strong practice in accountability.

Legitimate Interest under GDPR

The GDPR Article 6(1)(f) accepts the legitimate interests of the data controller or third party as legal basis under certain circumstances.

This point differs terminology from the text of the KVKK; the KVKK provision focuses on the legitimate interest of the data controller.

EDPB Guidelines 1/2024

In 2024, the EDPB opened Guidelines 1/2024 on legitimate interests under Article 6(1)(f) for public consultation.

As of September 2026, work on the final version of this guidance appears among the planned items in the EDPB’s 2026–2027 work programme.

The consultation version should therefore not be presented as “final binding 2026 guidance”.

The GDPR Three Stage Approach

Under GDPR, the assessment generally follows these steps:

identifying the legitimate interest,
assessing whether processing is necessary,
balancing it against the data subject’s interests, rights and freedoms.

The assessment covers all three steps.

Example: Monitoring Corporate Email

An employer may have an interest in security or business continuity. However, the scope of access to employee communications, prior information, less intrusive alternatives and access permissions must also be assessed.

Example: Camera

Even where cameras are necessary for security, recording audio for the same purpose requires a separate assessment of necessity and proportionality.

Documenting Legitimate Interests

A practical record may include:

purpose of processing,
legitimate interest,
necessity of processing,
alternative methods,
processed data categories,
reasonable expectation of the person concerned,
impact on rights and freedoms,
risk reduction measures,
Result.

Legitimate Interest Checklist

Is the interest real and current?
Is the interest lawful?
Is it really necessary to process personal data?
Is a less intrusive alternative available?
What could the data subject reasonably expect?
Is a child or vulnerable group involved?
Has the amount of data been minimized?
Have the right to object and the data subject’s other rights been considered?
Has the analysis been recorded in writing?

The B10 Approach

B10 Digital Agency does not limit its analysis of processing grounds to written documents. It uses a technical inventory to assess actual processing in CRM, analytics, employee systems, AI and other data flows.

Conclusion

Legitimate interest is not a way to say “we do not want to obtain explicit consent”. Processing must be necessary, and a genuine balance must be struck between the data controller’s interest and the data subject’s rights.

This content is for general informational purposes; concrete data processing activity should also be evaluated.