Legitimate Interest Documentations

Compliance officers and Data Protection Officers use the Legitimate Interest Documentations screen to create, maintain, and review the three-stage assessments required whenever your organisation relies on "legitimate interest" as its GDPR lawful basis — keeping you audit-ready and ensuring every processing activity is properly justified in writing.

When your organisation processes personal data on the basis of "legitimate interest" under Article 6(1)(f) of the GDPR, you need more than a checkbox — you need a documented, reasoned argument. The Legitimate Interest Documentation (LID) screen is where that argument lives. It guides you through a structured three-part test: confirming the interest is genuine (General), demonstrating the processing is necessary (Necessity), and weighing your organisation's interest against the rights of the individuals affected (Balancing of Interests). Once completed, these records can be linked to your Records of Processing Activities (ROPA), attached to assessments and tasks, and shared with other parts of your organisation.

How to open it

In the left-hand navigation sidebar, go to Privacy → Legitimate Interest. This takes you directly to the list of all existing LID records.

You need at least read permission for Legitimate Interest records to reach this screen. If the menu item is missing entirely, contact your system administrator to have the appropriate access granted. Creating new records requires an additional create permission; editing requires an edit permission.

What you see

The index screen shows a table of all LID records you have permission to view. At the top right is the blue Create button. Above the table is a search bar for filtering by name or keyword. The table itself has columns for Name, Organisational Unit, Affected Persons, and Created At. Each row represents one LID; clicking it opens the full record.

Once you open a record, the detail screen has two main areas. On the left is a narrow vertical menu — the Element Menu — listing the five sections of a LID: General, Necessity, Balancing of Interests, Tasks, and Assessments. On the right is the content area for whichever section is active. At the very top of the content area, a sticky header bar always shows the record's responsible person(s), its current status badge, and its last-updated date — no matter how far you scroll. A breadcrumb trail just above the content area shows exactly where you are and provides quick-navigation arrows to step between records and tabs without going back to the list.

Working with this screen

Creating a new Legitimate Interest Documentation

Start on the index screen and click Create → Create Legitimate Interest. The form opens on the General tab.

Fill in the Name — something descriptive enough that colleagues will recognise the processing activity at a glance, such as "Marketing Analytics – Returning Customers". Select the Organisational Unit responsible for this activity, add one or more Affected Persons tags (for example, "Customer" or "Employee"), and write a Short Description explaining the purpose of the processing and why your organisation believes it has a legitimate interest. Set the Status to Draft and assign Responsible Person(s) from the sticky header at the top.

When you are ready, click Next. DPMS saves the General information and moves you straight to the Necessity tab — this is by design, because the three-stage test must be completed in sequence.

On the Necessity tab, you answer four questions in free-text fields: whether the processing will actually achieve your stated goal, whether the goal could be achieved without processing personal data at all, whether the amount of data processed is proportionate, and whether less privacy-invasive alternatives exist. Answer as fully as you can — these answers form the legal justification record. Click Next again.

DPMS now takes you to the Balancing of Interests tab. Here you address the third stage of the test: the impact on individuals. You can indicate whether the processing is personal or professional in nature using a dropdown, describe the organisation's relationship with the affected persons, explain whether the data was collected directly or from a third party, and assess the likely effects of the processing on the individuals concerned. Two fields — Personal Data and Special Categories — are pulled automatically from any linked ROPA record and cannot be edited here. If they appear empty, you will need to link the LID to a ROPA entry first (see the ROPA module).

Click Save. DPMS saves the completed record and returns you to the detail view, where you can review everything you have entered.

Reviewing and promoting a record to Active

When a DPO or compliance officer has finished reviewing a draft LID, they promote it to Active to signal that the documentation is complete and approved.

Open the record from the index list (use the search bar if needed to find it quickly). Step through the General, Necessity, and Balancing of Interests tabs to read the content. You can use the small left/right arrows in the breadcrumb trail to move between tabs without clicking the sidebar. If any section needs updating, click the Edit button visible on that tab's view to go straight to the edit form for that section only.

Once you are satisfied, click the Status badge in the sticky header and select Active from the dropdown. The badge updates instantly — no page reload required. The change is logged on the record so there is a clear audit trail of when the status changed.

Stepping through multiple records efficiently

If you are reviewing a batch of LIDs — for example, before an audit — you do not need to return to the index list between each one. The left and right chevron arrows in the breadcrumb area let you jump directly to the previous or next record in the current list. If you have searched or filtered the list before opening a record, the navigation follows that filtered order, making it easy to work through a specific subset of records one by one.

Linking assessments or tasks to a LID

Open the LID's detail view and click Assessments or Tasks in the left-hand Element Menu. To add a link, click the Edit button on that tab, which opens the edit form with the linked-table interface active. Use the search field in the table to find the assessment or task you want to attach, select it, and save. The linked item now appears in the table on that tab.

This is particularly useful when a Data Protection Impact Assessment (DPIA) or a risk assessment has been conducted to support the legitimate interest claim — linking it here keeps all the evidence together in one place.

If your organisation has the Group Sharing feature enabled in IT Settings, you can share a completed LID with other business units. Open the record, then click the ellipsis (⋯) icon in the top-right corner of the content area. Select Sharing from the menu that appears. This takes you to the Group Sharing configuration for this record, where you can choose which units to share it with. The Sharing option only appears if your account has publish permission and if the IT administrator has activated the Sharing feature.

Bulk-exporting records for an external audit

On the index screen, tick the checkbox at the left of each row you want to export — or use the header checkbox to select all visible records. An action bar appears at the bottom of the screen. Choose Export and select either XLSX or JSON as your file format. DPMS generates and downloads the file immediately. XLSX is the most practical format for sharing with external auditors who need to work in spreadsheet tools.

Field reference

Name — The title of the LID. Make it descriptive enough to identify the processing activity unambiguously. Supports multiple languages. Required in practice — a record without a name cannot be meaningfully identified in the list.

Organisational Unit — The department or team responsible for this processing activity. Selected from a dropdown; a new unit can be created on the fly if needed. Optional, but strongly recommended for filtering and ownership tracking.

Affected Persons — One or more tags representing the categories of individuals involved (e.g., Customer, Employee, Website Visitor). Tags are managed centrally in Compliance Settings. Optional; multi-select.

Short Description — A free-text explanation of the processing purpose and the organisation's legitimate interest claim. Not formally required, but this field forms the foundation of the justification — leave it blank only if the information is captured elsewhere.

Necessity tab fields — Four free-text areas covering: (1) whether processing achieves the goal, (2) whether the goal could be achieved without processing, (3) proportionality of the data processed, and (4) whether less intrusive means exist. All optional in terms of system validation, but legally essential for a complete LIA.

Balancing tab — Is data processing personal or professional? — A dropdown with two options: Processing Personal or Processing Professional. This characterises the nature of the relationship between the organisation and the affected individuals, which influences the weight given to individual rights.

Balancing tab — Personal Data and Special Categories — Read-only fields populated automatically from any linked ROPA record. If these are blank, the LID has not yet been linked to a ROPA entry. You cannot enter values here manually.

Status — Set in the sticky header. Default options are Draft, Active, Inactive, and Review. Your organisation may have additional custom statuses configured in Compliance Settings. Changing the status here updates the record immediately.

Responsible Person(s) — A multi-select people-picker in the sticky header. Assign one or more team members who own this LID. This field accepts multiple people; if you see only one person listed, that is the result of a migration from an older single-person format — the field works normally for new assignments.

How this connects to the rest of DPMS

Legitimate Interest Documentations sit at the intersection of several DPMS modules. The most important connection is with ROPA: when a Record of Processing Activity uses "Legitimate Interest" as its legal basis, it references an LID. The Balancing of Interests tab pulls its Personal Data and Special Categories values directly from that linked ROPA record, so keeping ROPA up to date keeps your LIDs accurate.

Assessments and Tasks linked on the respective tabs make it possible for risk managers and DPOs to trace the full evidence chain — from the original LID through to any DPIA, risk assessment, or follow-up action. The Group Sharing feature (via the ellipsis menu) allows approved LIDs to be published to other parts of your organisation, avoiding duplication when the same legitimate interest applies across multiple units.

Tips & common pitfalls

Heads up: When you click Next on the General tab during creation, DPMS takes you to the Necessity tab — not back to the detail view. This is intentional (the wizard is designed to be completed in one sitting), but it surprises users who only wanted to save the basics and return later. If that is your plan, finish the Necessity and Balancing tabs with placeholder text first, then come back to edit the full content.

Tip: Use the breadcrumb chevron arrows to step through a batch of records during a review. It is much faster than returning to the index list each time, and it respects whatever search filter you had active.

You cannot jump to the Necessity or Balancing tabs on a brand-new record until you have saved the General tab at least once. If a tab appears unresponsive when clicked, this is why — save General first.
The Personal Data and Special Categories fields on the Balancing tab are populated from a linked ROPA record. If they are empty, link the LID to the relevant ROPA entry before finalising the balancing assessment.
The status filter tabs (Active, Draft, Inactive, Review) visible on the index screen are not currently active. Use the search/filter bar to narrow down records by status or other criteria.
The Sharing option in the ellipsis menu only appears if Group Sharing is enabled in IT Settings and you have publish permission. If you cannot see it, ask your IT administrator to check whether the Sharing feature has been activated.
Responsible persons is a multi-select field. You can assign more than one person to a LID — useful when responsibility is shared between a business owner and the DPO team.