Following on from our post around lawful basis in September, let’s dive in with a deeper look at legitimate interests.
You’re sitting at your desk, reviewing your school’s privacy notice, and there it is again:
“We process personal data where necessary for our legitimate interests.”
It’s a phrase you’ve seen in countless templates, DPIAs, and supplier agreements. But since the Data Use and Access Act 2025 came into force, you find yourself asking:
What does “legitimate interests” actually mean now? And how do I use it responsibly in a school setting?
Because here’s the truth: the landscape has changed.
What was once a flexible and widely used lawful basis under UK GDPR is now subject to greater scrutiny and clearer expectations.
And you need to be ready.
First: A Refresher on Legitimate Interests
At its core, legitimate interests allows you to process personal data without needing consent, as long as:
- You have a clear and genuine interest (yours or a third party’s),
- The data use is necessary to achieve it,
- And your interest doesn’t override the individual’s rights and freedoms.
Simple? Not quite.
Legitimate interest isn’t a free pass. It’s a balancing act. One that now requires more than just good intentions.
What the Data Use and Access Act Changes
The 2025 Act doesn’t throw out legitimate interests, but it tightens the rules around it, particularly in public sector settings like schools.
Here’s what’s new:
- Recognised Categories of Legitimate Interest
The Act introduces “recognised legitimate interests”. A defined list of purposes where the balancing test is still required, but more likely to pass, especially in regulated environments like education.
These include:
- Safeguarding and welfare monitoring
- IT security and misuse prevention
- Internal data analytics for educational improvement
- Health and safety incident logging
- Communications with former pupils (e.g. alumni outreach)
This doesn’t give you automatic permission, but it gives you a stronger footing, provided you still assess necessity and impact.
- Mandatory Legitimate Interest Assessments (LIAs)
Whereas under UK GDPR, LIAs were strongly recommended but not mandatory, the new Act requires written documentation of your balancing test for all non-trivial uses of legitimate interest.
This includes:
- The purpose and justification
- Why the data is necessary
- Potential risks to the individual
- Mitigating actions you’ve taken
In other words: if you can’t show your thinking, it doesn’t count.
- More Transparency in Privacy Notices
The Act demands greater clarity in how you explain legitimate interest to data subjects.
Saying “We do this for our legitimate interests” is no longer enough.
Now you must:
- Describe the actual purpose (“To improve learning outcomes across year groups”)
- State the lawful basis clearly
- Explain the individual’s right to object, and how they can do it
This isn’t just legal hygiene, it’s about building trust.
Real-Life Scenarios You Might Recognise
Let’s put this into context. Here are a few examples of recognised legitimate interests that now carry clearer boundaries under the Act:
Using Assessment Data for Internal Improvement
You aggregate anonymised pupil data to review trends and improve teaching strategies.
– Recognised legitimate interest
– You still need to ensure no unintended profiling or bias is introduced.
Contacting Alumni About School Events
You keep in touch with former pupils for fundraising or newsletters.
– Now listed as a recognised interest, but you must allow opt-outs and be proportionate.
Monitoring Staff IT Activity
You review system logs to detect inappropriate use of school devices.
– Still valid, but the Act now emphasises proportionality and the need for staff to be informed via policy and training.
Using CCTV for Security
– Covered by recognised interest, but the Act now expects specific signage and policies outlining how footage is used and retained.
What You Should Do Now
If you’re relying on legitimate interests in any part of your school’s data processing, take a moment to check:
- Have you documented your legitimate interest assessments?
- Is your privacy notice specific and accessible?
- Have you reviewed whether your interests are listed in the new recognised categories?
- Have you trained staff on when legitimate interests apply and when they don’t?
And most importantly:
- Can you explain your decision clearly to a parent, pupil, or regulator?
One Final Thought
Legitimate interests used to be the “quiet lawful basis” sitting in the background while consent and legal obligation took the spotlight.
But now, it demands more from you.
More transparency. More justification. More trust.
So the next time you tick that box, ask yourself:
“Would I be comfortable explaining this decision face-to-face with the person it affects?”
If the answer is yes, you’re likely on solid ground. If not? It might be time for a rethink.
