legitimate interests policy
Date Reviewed: 16th march 2026
Effective Date: 2nd november 2023
Next Review Due: 16th march 2027
1: introduction
This policy outlines the procedures and considerations for relying on legitimate interests as the lawful basis for processing personal data. It ensures that I fully assess and protect individuals’ rights and interests in line with the UK General Data Protection Regulation (UK GDPR).
Legitimate interests are generally used for limited practice management activities rather than the core provision of therapy services, which are typically processed under other lawful bases such as contract or provision of healthcare.
2: Understanding Legitimate Interests
Legitimate interests provide a flexible basis for processing personal data. It is most appropriate when:
- Examples may include managing client enquiries, maintaining practice administration systems, ensuring IT security, preventing fraud, or improving the quality and efficiency of services.
3: Applying the Three-Part Test
Before relying on legitimate interests, I perform a Legitimate Interests Assessment (LIA) using the three-part test:
Identify the Legitimate Interest(s)
- Purpose: Determine why I want to process the data and what I aim to achieve.
- Beneficiaries: Identify who benefits from the processing and how.
- Public Benefits: Assess any wider public benefits and their importance.
- Impact of Non-Processing: Consider the impact if processing does not proceed.
- Ethical Considerations: Ensure the processing is ethical and lawful.Apply the Necessity Test
- Purpose Fulfilment: Assess if the processing advances the identified legitimate interest.
- Reasonableness: Evaluate if the processing is a reasonable approach to achieve the goal.
- Less Intrusive Methods: Consider if there are less intrusive ways to achieve the same result.
- Perform the Balancing Test
- Relationship: Reflect on the nature of my relationship with the individual.
- Data Sensitivity: Consider if any data is particularly sensitive or private.
- Expectations: Assess if individuals would reasonably expect their data to be used in this way.
- Transparency: Determine if I can clearly explain the processing to individuals.
- Objections: Evaluate if the processing might be seen as intrusive or if individuals might object.
- Impact Assessment: Consider the potential impact on individuals and its significance.
- Vulnerable Groups: Check if the processing involves children or other vulnerable individuals.
- Safeguards and Opt-Out: Explore possible safeguards to minimize impact and whether an opt-out option can be offered.
- Where processing involves children or other vulnerable individuals, additional care is taken to ensure that their rights and interests are protected.
4: Responsibilities
If I rely on legitimate interests, I take on the responsibility to:
- Consider and Protect Rights: Thoroughly assess and protect individuals’ rights and interests.
- Document Decisions: Maintain clear records of the LIA process, including identified interests, necessity, and balancing considerations.
- Review Practices: Regularly review processing activities to ensure continued compliance and appropriateness of relying on legitimate interests.
- Where legitimate interests are relied upon, individuals have the right to object to the processing of their personal data. Any objections will be carefully considered in line with UK GDPR requirements.
- Records of Legitimate Interests Assessments are retained securely as part of my practice governance documentation.
5: policy review
This policy will be reviewed annually or as needed to reflect changes in legislation, operational practices, or guidance. Updates will be communicated as necessary.
6: contact
For any queries regarding this policy or to request further information, please contact me at:
Email: adhdslt@outlook.com
Website: www.adhdslt.co.uk
Signed: Jamie Louise Hollis, ADHD SLT
Job Title: Speech and Language Therapist