Legitimate Interest Assessment / LIA GDPR Template Package 2026 – Word/PDF/Excel

Legitimate Interest Assessment (LIA) / GDPR 2026 – complete template package

A complete documentation package for Legitimate Interest Assessment (LIA) pursuant to Article 6(1)(f) GDPR. The package helps companies and organizations document the entire three-part test: legitimate interest, necessity, and the balancing against the interests, rights, and freedoms of the data subject. It also includes a separate Article 21 assessment for objections, ongoing review, and an Excel tool for registers and control.

The template package is legally reviewed as of October 3, 2026, against the GDPR, the Swedish Authority for Privacy Protection's (IMY) current Swedish guidance, and EDPB Guidelines 1/2024 on Article 6(1)(f).

Included – 9 files

• Legitimate Interest Assessment / LIA 2026 – Word (DOCX)
• Legitimate Interest Assessment / LIA 2026 – PDF
• Objection assessment pursuant to Article 21 – Word
• Objection assessment pursuant to Article 21 – PDF
• LIA Review & change log – Word
• LIA Review & change log – PDF
• Guide to Legitimate Interest Assessment – Word
• Guide to Legitimate Interest Assessment – PDF
• Excel tool for LIA register, balancing matrix, objections, and review

The three-part test pursuant to Article 6(1)(f)

For a legitimate interest assessment to be used, three cumulative conditions must be met:

1. Legitimate interest: the interest must be lawful, sufficiently specific, real, and current.
2. Necessity: the processing of personal data must be necessary to achieve the legitimate interest. If the same goal can reasonably be reached just as effectively with less privacy intrusion, it weighs against Article 6(1)(f).
3. Balancing: the interests, fundamental rights, and freedoms of the data subject may not override the legitimate interest.

Reasonable expectations

The template contains a specific balancing matrix regarding, among other things, the relationship with the data subject, how the data was collected, what the data subject can reasonably expect, the nature of the data, the scope of processing, storage period, profiling, children and other vulnerable individuals, power imbalance, and potential negative consequences.

IMY emphasizes that an overall assessment must be made in each individual case. That processing is practical or commercially desirable is not in itself sufficient.

Documentation and accountability

IMY recommends that the legitimate interest assessment be documented so that the controller can demonstrate how the assessment was performed. The package therefore provides separate fields for purpose, legitimate interest, alternative solutions, data minimization, reasonable expectations, safeguards, and final conclusion.

Article 21 – when the data subject objects

A separate template helps the organization assess objections to processing based on Article 6(1)(f). For processing other than direct marketing, after an objection, the controller must be able to demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, or that the processing is necessary for the establishment, exercise, or defense of legal claims.

Direct marketing

Recital 47 of the GDPR states that processing for direct marketing may be regarded as a legitimate interest. However, this does not mean that all direct marketing is automatically permitted. Necessity, balancing, transparency, and other applicable marketing/ePrivacy regulations must still be assessed. If the data subject objects to direct marketing, the processing for that purpose must cease.

Children, employees, and other vulnerable groups

Children have special protection under the GDPR. The template therefore contains specific checkpoints for children and other vulnerable data subjects. In the workplace, the power imbalance between employer and employee is also considered, as well as what the employee can reasonably expect in the current work environment.

AI and new technical use cases

Legitimate interest assessment may also need to be evaluated when developing or using AI. The package therefore contains checkpoints for data minimization, profiling, new technology, automation, and reasonable expectations. Commercial benefit can in some cases be a legitimate interest, but it does not determine the necessity or balancing step.

Public authorities

Article 6(1)(f) may not be used by public authorities when processing personal data in the performance of their public tasks. The template therefore contains a special check for this.

Transparency pursuant to Articles 13 and 14

When Article 6(1)(f) is used, the data subject must be informed about the legitimate interest. The package contains checkpoints to ensure that the privacy notice describes the legal basis, the legitimate interest, and the right to object.

Excel tool

The Excel version contains a dashboard and separate sheets for:

• LIA register and three-part test
• balancing matrix from the data subject's perspective
• Article 21 objections
• review and change log
• final checklist
• legal sources

The tool automatically highlights incomplete assessments, open objections, and overdue reviews.

Legal basis

The template package is based on, among other things:

• The General Data Protection Regulation (EU) 2016/679, particularly Articles 5, 6(1)(f), 13, 14, and 21, as well as Recital 47
• IMY’s guidance on legitimate interest assessment
• EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
• EDPB’s One-Stop-Shop Case Digest: Legitimate Interest 2026

Who is the package for?

• companies that use legitimate interest as a legal basis
• data protection officers, GDPR managers, and compliance functions
• HR, security, IT, and marketing
• organizations that need to demonstrate accountability during audits
• businesses that need to handle objections pursuant to Article 21

Note

An LIA is not a general permission for all future processing. The assessment must be linked to a specific purpose and a concrete processing activity and should be reconsidered when purpose, technology, data categories, recipients, scope, or the data subject’s reasonable expectations change. Sensitive personal data and data on criminal convictions additionally require separate legal support pursuant to Articles 9 and 10, respectively.

Format: Word (DOCX) + PDF + Excel (XLSX)
Language: Swedish
Jurisdiction: Sweden / EU
Number of files: 9
Version: 1.0 – 2026-10-03