# Legitimate interest assessment

A short LIA for outreach to contacts sourced from a public group. Two
paragraphs plus the balancing test is a defensible record under GDPR Article
6(1)(f). Complete one per source group, before you send.

This is a working template, not legal advice. If you operate at scale or in a
regulated sector, have counsel review it.

---

## 1. Identify the interest

| Field | Your answer |
|---|---|
| Controller | [Legal entity name and address] |
| Date of assessment | |
| Source group | [Name and link] |
| Date obtained | |
| Number of records | |
| Data collected | [e.g. username, display name, user id. Note anything beyond this.] |

**The purpose.** We process this data to contact individuals who have publicly
participated in [group name], a forum whose stated subject is [topic], in order
to introduce [product], which addresses [problem] in that same subject area.

**Why the interest is legitimate.** Direct marketing to a professional audience
is recognised as a legitimate interest (GDPR Recital 47). The individuals in
this group have publicly indicated an interest in [topic]. Our product operates
in that field, so the message is relevant to the reason they joined.

## 2. Necessity

Could you achieve the purpose another way, with less data?

> [Answer honestly. If paid advertising to the same audience would work, say so
> and explain why it is not proportionate for your size, or accept that
> legitimate interest is weaker here.]

We collect only [list the fields]. We do not collect [message content, phone
numbers, contact lists, or anything else you are not taking] .

## 3. The balancing test

| Question | Assessment |
|---|---|
| Would the individual reasonably expect this contact? | [Consider: is the group explicitly professional? Does its description mention business use?] |
| What is the likely impact? | [One unsolicited message, with an opt-out in it, is a low impact. Repeated messages are not.] |
| Is any of the data sensitive? | [If the group topic reveals health, politics, religion, sexuality or similar, STOP. Article 9 applies and legitimate interest is not available.] |
| Are any subjects likely to be children? | [If plausible, stop.] |
| Can they object easily? | [Every message must carry a working opt-out.] |

**Conclusion.** [State whether the interest is or is not overridden. If in
doubt, it is overridden.]

## 4. Safeguards we apply

- Every first message contains a one-line opt-out instruction.
- An opt-out is honoured permanently and across all senders and channels.
- Contacts are tagged with the source group and date, so any subject access
  request can be answered accurately.
- Data is deleted after [N] months without engagement.
- We do not sell, share or enrich this data with third-party sources.
- Volume is capped at [N] messages per account per day.

## 5. Review

| Field | Value |
|---|---|
| Completed by | |
| Date | |
| Next review | [12 months, or sooner if the practice changes] |

---

## The two things that actually matter

**Sensitive-topic groups are out.** If the group's subject would reveal health,
political opinion, religion, trade union membership, sexuality, or ethnicity,
Article 9 applies and this template does not help you.

**The opt-out has to work.** A documented LIA with a broken opt-out is worse
than no LIA, because it demonstrates you thought about it and did it anyway.