Legitimate Interest Under LGPD: When Can Your Business Use It?

Legitimate interest is often attractive to businesses because it does not require the same affirmative permission mechanism as consent. That does not make it a “no-consent exception” that can be applied whenever collecting consent would be inconvenient.

Article 7(IX) creates the legal basis, but Article 10 supplies the operational limits. ANPD's official guide then explains how to convert those limits into a documented decision.

The Core Requirements for Legitimate Interest

1. The interest must be legally legitimate

ANPD says an interest is legitimate when it satisfies three conditions: it is compatible with the legal system, grounded in concrete circumstances, and connected to legitimate, specific and explicit purposes.

“Improve our business” is usually too abstract to do the work on its own. “Detect automated credential-stuffing attacks using limited login-event data for 30 days” is much closer to a purpose that can actually be assessed.

2. The processing must be necessary

Article 10(1) is unusually direct: when legitimate interest is used, only personal data strictly necessary for the intended purpose may be processed.

ANPD says the controller should also ask whether another reasonable, less intrusive way could achieve the same purpose. That makes necessity both a data-minimization test and a method-selection test.

3. The individual's rights and freedoms can defeat the basis

A real commercial benefit is not enough by itself. The controller must assess whether the processing would create disproportionate impacts, violate reasonable expectations or otherwise cause the person's rights and freedoms to prevail over the claimed interest.

ANPD's Three-Phase Legitimate Interest Balancing Test

ANPD says processing based on legitimate interest should be preceded by a balancing test. Its model is not legally mandatory in one prescribed form, but the Agency describes the test as an important accountability tool and provides a simplified template.

Does every balancing test need to be 20 pages?

No. ANPD says there is no single required approach. A clearly low-impact processing operation may support a shorter assessment, while new technologies involving massive amounts of personal data can require a much more detailed and robust analysis.

What Are the Data Subject's “Legitimate Expectations”?

Legitimate expectations are not simply whatever the controller wrote into a privacy policy. ANPD says the business should be able to demonstrate that the intended processing is reasonably expected by people in that context.

The Agency identifies factors including:

• whether the controller already has a prior relationship with the individual;
• whether the data was collected directly, received from third parties or taken from public sources;
• the context and time of collection; and
• the original collection purpose and its compatibility with the later legitimate-interest processing.

The more surprising, intrusive or disconnected the new use is from the original relationship, the harder it becomes to show reasonable expectations.

Does putting something in the privacy policy make it expected?

Transparency is important, but disclosure alone cannot turn disproportionate processing into legitimate processing. ANPD's employee-monitoring example demonstrates this point clearly.

A company proposed using software that captured webcam images and everything employees typed to measure productivity and detect disclosure of confidential information. ANPD concluded in that example that the collection was excessively intrusive and went far beyond what was necessary, especially given employees' vulnerable position and limited ability to oppose the processing.

The guide says the processing would not become acceptable merely because it had been previously disclosed in a privacy policy.

Can Legitimate Interest Be Used for Marketing?

Sometimes—but “marketing” is far too broad to answer with a universal yes or no.

ANPD's legitimate-interest guide provides a useful positive example. A private university that also operates a publishing activity sends students, teachers and employees promotions and discounts for books and cultural/artistic products. The organization has a prior relationship with the recipients, the products are directly related to the academic/professional context, the data is not unnecessarily shared with third parties, and recipients receive an unsubscribe mechanism.

ANPD says that, in that scenario, the interest can be legitimate and the safeguards support the analysis.

Third-party promotions

The guide also describes a university sharing a promotional campaign from a language school with its own employees. ANPD says a third party's interest can potentially support legitimate interest, but the same requirements apply: the controller should perform the balancing test, give prior transparency and provide a way to stop receiving those promotions.

When marketing becomes harder to justify

The analysis becomes more difficult as processing becomes more intrusive or surprising:

• data purchased from unrelated brokers;
• large-scale profiling using multiple data sources;
• cross-site tracking;
• behavioral prediction;
• high-frequency targeting;
• use of vulnerable-person data; or
• marketing unrelated to the context in which the data was obtained.

Analytics, Necessary Cookies and Advertising Tracking

ANPD's cookie guidance gives particularly useful examples of where legitimate interest may or may not fit.

ANPD says consent may be more appropriate for advertising cookies in those higher-risk circumstances. This is why a company should not simply label Google Analytics, Meta Pixel, ad tags and server-side tracking as one “analytics” purpose. Their configurations can have very different data flows and risk profiles.

For the full analysis, see LGPD Cookie Consent Requirements: Analytics, Pixels and Advertising.

Employees and Workplace Monitoring

Legitimate interest can be considered in employment contexts, but the power imbalance between employer and employee makes the legitimate-expectations and proportionality analysis especially important.

ANPD's employee-monitoring example is deliberately extreme: webcam capture plus logging everything employees type. The Agency's analysis says the processing goes far beyond what is necessary and is disproportionate to the stated productivity and confidentiality purposes.

A stronger workplace assessment should ask whether the purpose can be achieved using less intrusive controls. For example, protecting confidential information may sometimes be addressed through access controls, DLP rules, audit logs or targeted security monitoring instead of continuous webcam/keylogging surveillance.

That does not mean every employee-monitoring technology is unlawful under legitimate interest. It means the actual method, intensity, purpose, necessity, vulnerability and ability to exercise rights must be assessed.

Fraud Prevention and Security: Ordinary vs Sensitive Data

This topic requires an important Article 7 / Article 11 distinction.

Ordinary personal data

ANPD says legitimate interest can be used, where the requirements are satisfied, for processing non-sensitive personal data for fraud-prevention and security purposes.

Examples might include limited login-event data, risk signals or security telemetry, subject to the purpose, necessity and balancing analysis.

Sensitive personal data

Article 7(IX) legitimate interest does not apply to sensitive data. Article 11(II)(g) separately provides a specific hypothesis for fraud prevention and the security of the data subject in electronic identification and authentication processes, under its statutory conditions.

ANPD says the balancing-test logic is also useful for that Article 11 fraud/security hypothesis because the law similarly requires consideration of whether the data subject's fundamental rights and freedoms prevail.

Security Cameras and Physical-Space Monitoring

ANPD's guide uses a shopping-center camera example to illustrate how legitimate interest can operate when security is the purpose. In that scenario, cameras help protect the site and users, including children who might become separated from their parents.

The safeguards matter: access to recordings is tightly controlled, retention is shorter, notices are displayed, biometric processing is avoided, and the number of cameras is minimized through security planning.

ANPD's example also says a RIPD should be prepared because of the high-risk characteristics present in the scenario.

The lesson is not “security cameras always equal legitimate interest.” The lesson is that a concrete security interest can qualify when the design is necessary, proportionate, transparent and supported by safeguards appropriate to the actual environment.

Can Legitimate Interest Be Used for Children's and Adolescents' Data?

Potentially, but the analysis is much stricter.

ANPD Enunciado No. 1/2023 says children's and adolescents' personal data may be processed using the legal bases in Article 7 or Article 11, provided their best interests are observed and prevail in the concrete case.

ANPD's legitimate-interest guide says a controller using legitimate interest for this group should document:

• what it considered to be the child's or adolescent's best interest;
• how that best interest and the person's rights were weighed against the controller's or third party's interest; and
• why the processing does not create disproportionate or excessive risk or impact.

The guide goes further: if the balancing test is inconclusive, adequate security/risk-mitigation measures cannot be identified, or a less intrusive alternative is available, another legal basis—or no processing—should be considered.

Positive example: school Wi-Fi security

ANPD describes a school collecting limited student data to authenticate access to its Wi-Fi network and protect students in the digital environment. The Agency says there are preliminary indications that legitimate interest can fit because the school has a direct prior relationship with students and the processing aims to support security and service access, subject to a balancing test and best-interest analysis.

Negative example: advertising to children

The same guide describes an educational app using children's data to display advertising for ultra-processed, high-sugar foods. ANPD says legitimate interest is not the most appropriate basis in that scenario because the advertising is not reasonably expected, transparency is inadequate and the best-interest analysis weighs against the controller.

Sensitive Data: A Hard Stop for Article 7(IX)

Sensitive personal data includes information about racial or ethnic origin, religion, political opinion, trade-union or certain organizational membership, health or sexual life, and genetic or biometric data linked to an individual.

ANPD's guide explicitly states that legitimate interest is not available for this category because Article 7(IX) was not reproduced in Article 11.

Transparency Is Mandatory Even Though Consent Is Not

One of the most dangerous misunderstandings is: “If we use legitimate interest, we do not need to tell the user.”

Article 10(2) says the controller must adopt measures to guarantee transparency. ANPD says people should receive clear, adequate and prominent information about the form, duration and specific purpose, controller identity/contact information and their rights and available channels.

This information also helps support legitimate expectations. A person cannot reasonably understand the use of their data if the use is hidden.

What about the right to object?

Article 18(2) gives the data subject a right to oppose processing based on a no-consent legal basis when the LGPD's requirements are not met. ANPD's legitimate-interest guide emphasizes making rights channels available so a person can challenge processing that the person believes violates legitimate expectations or otherwise contravenes the LGPD.

Do not simply copy a GDPR “absolute right to object to direct marketing” statement into an LGPD workflow without checking the Brazilian legal framework. The rights structures are similar in some respects but not identical.

What Should Be in a Legitimate Interest Assessment?

Do you need to keep records?

Yes. Article 37 requires controllers and operators to keep records of processing operations, especially when processing is based on legitimate interest. ANPD says the documentation can include the balancing test itself, the nature of the data, the legitimacy of the claimed interest, the comparison against the person's rights and expectations, and the best-interest evidence where children are involved.

Do you need a RIPD?

Not every legitimate-interest operation automatically requires a Data Protection Impact Report. But Article 10(3) allows ANPD to request one where processing is based on legitimate interest, and ANPD's guidance highlights RIPDs where high-risk processing is present.

A practical governance rule is to escalate the assessment when the processing involves large scale, new technology, extensive monitoring, vulnerable people, significant profiling, high potential harm or other high-risk characteristics.

Legitimate Interest vs Consent

Common Legitimate Interest Mistakes

“It benefits our business, so it is legitimate.”

Business benefit is only the beginning. The interest must be legally compatible, concrete and connected to a specific legitimate purpose.

“We put it in the privacy policy, so users expect it.”

Disclosure supports transparency but does not cure excessive or disproportionate processing. ANPD's employee-monitoring example makes that explicit.

“There is some risk, so legitimate interest cannot be used.”

ANPD says the LGPD does not require zero impact. The question is whether impacts are appropriately identified, minimized and balanced with safeguards.

“Analytics always equals legitimate interest.”

No. ANPD's favorable analytics example is narrow: limited audience measurement, aggregate patterns and trends, no combination with other tracking mechanisms and no user profiling.

“Fraud prevention always equals Article 7 legitimate interest.”

Not for sensitive data. Biometric and other sensitive data must be analyzed under Article 11.

“If the user can opt out, the balancing test is automatically passed.”

An opt-out can be a useful safeguard, but it cannot make an illegitimate, unnecessary or excessively intrusive operation lawful.

“One balancing test covers every future purpose.”

ANPD recommends a test for each specific purpose. A new purpose should trigger a new legal-basis analysis and, if legitimate interest is used again, a new balancing assessment.