Writing a Legitimate Interest Assessment for AI Training

Legitimate interests is the only lawful basis under which large-scale model training is realistically defensible, and it is the only basis that requires you to write down your reasoning before you rely on it. The structure of that document is not a matter of taste: it follows the three conditions the Court of Justice reads into Article 6(1)(f).

The three cumulative conditions

Article 6(1)(f) of Regulation (EU) 2016/679 permits processing necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child.

The Court of Justice set out the structure in Case C-13/16, Rīgas satiksme, decided 4 May 2017 and available from the Court’s case register: three cumulative conditions must be met — the pursuit of a legitimate interest, the necessity of the processing for that interest, and that the interests or fundamental rights of the data subject do not take precedence. The European Data Protection Board applied the same three-step structure to AI models in Opinion 28/2024, adopted 17 December 2024, which is the document to read before writing one of these.

Two structural points before the steps. Article 6(1)(f) is unavailable to public authorities in the performance of their tasks. And the assessment has to be done before the processing: an LIA written after a training run is evidence of nothing except that somebody asked afterwards.

Step 1: is the interest legitimate?

The bar for legitimacy is lower than most drafters assume. In Case C-621/22, decided 4 October 2024 and available from the Court’s case register, the Court held that a purely commercial interest can constitute a legitimate interest, provided it is lawful and the other two conditions are satisfied. So “we want to build a product and sell it” clears step one. What does not clear it is an interest that is unlawful, or one stated so vaguely that steps two and three cannot be run against it.

The mistake to avoid is a purpose statement at the wrong altitude. “Improving our AI” is not assessable. Write the interest at the level at which somebody could disagree with it:

Interest:  Training a domain-specific model so that our support
           assistant answers product questions accurately in the
           customer's own terminology.
Whose:     Ours (controller). Third-party interest also engaged:
           customers who receive faster, more accurate support.
Lawful:    No sectoral prohibition applies to the processing.
Real and   The model is in production; this is not a speculative
present:   future benefit.

If the interest is third-party rather than your own, say so — Article 6(1)(f) covers interests pursued by a third party, and naming them strengthens the balancing at step three.

Step 2: is the processing necessary?

Necessity is not convenience and it is not cost. The question is whether the interest can reasonably be achieved by means less intrusive to the data subject, and it is answered by working through the alternatives and recording why each was rejected. The alternatives that a regulator will expect to see considered, for a training scenario, are:

• Synthetic or licensed data in place of personal data. Rejected on grounds of what, specifically? Coverage of the domain vocabulary is a real answer; “more expensive” is a weak one.
• Anonymised or aggregated data. If the training signal survives anonymisation, the processing of personal data is not necessary and the analysis stops here. This is the alternative most often skipped and it is the strongest one against you. The threshold for anonymisation is discussed on anonymisation and pseudonymisation of training data.
• A smaller corpus. If a subset achieves the objective, the surplus is not necessary. This is the point where necessity meets the argument on data minimisation and large training datasets.
• Fields removed. Necessity is assessed per category of data, not for the dataset as a whole. Direct identifiers, contact details and free-text fields likely to contain special-category data each need their own line.
• Retrieval instead of training. Where the objective is factual accuracy about your own content, grounding at inference time frequently achieves it without incorporating personal data into weights at all — a genuinely less intrusive means that has to be addressed rather than assumed away.

Step 3: the balancing test

The third condition asks whether the data subject’s interests, fundamental rights and freedoms override yours. EDPB Opinion 28/2024 treats reasonable expectations as central to this assessment, and for training data that is where most of the argument happens.

The data subject’s side

• Nature of the data. Special-category data under Article 9 cannot ride on Article 6(1)(f) at all — it needs an Article 9(2) condition, and for training data the realistic candidates are narrow. Financial and location data weigh heavily even where they are not special category.
• Relationship and expectations. A customer who wrote a support ticket expected it to be read by support. Whether they reasonably expected it to train a model is the question, and the answer depends on what you told them and when. A person whose public post was scraped has no relationship with you at all, which is the weakest position on this factor — see the lawful basis for web scraping.
• Impact. The realistic harms are memorisation and regurgitation, inference of attributes the person did not disclose, and loss of control over data that cannot be withdrawn from a trained model. State them; a balancing section that finds no impact is not credible.
• Vulnerability. Article 6(1)(f) names children expressly. Employees and patients raise the same power-imbalance concern.

Your side

The weight of the interest, whether the benefit accrues to the data subjects themselves or only to you, and whether there is any wider public benefit. Be honest about the split — an LIA claiming that users benefit from a model trained on their data, when the benefit is a general product improvement they may never see, is the kind of overstatement that undermines the whole document.

Mitigations that move the balance

Opinion 28/2024 is explicit that mitigating measures are relevant to the balancing, which means a documented mitigation can turn a losing assessment into a passing one. Measures that carry weight because they are checkable:

• Deduplication and memorisation testing of the corpus, with a recorded method and result.
• Removal or masking of direct identifiers before training, with the fields listed.
• Filtering of categories likely to contain Article 9 data, with an acknowledgement of what the filter misses.
• An unconditional, easy opt-out that is honoured for future training runs, publicised beyond the privacy notice.
• Output filtering to prevent reproduction of memorised personal data.
• A stated retention period for the corpus itself, rather than indefinite retention.
• Transparency delivered in advance of the training run rather than concurrently with it — Article 14(3) timing matters where the data was not collected from the data subject.

Writing the document

1. State the interest in one paragraph, at the altitude shown above, and identify whose interest it is.
2. Define the processing precisely: which corpus, which fields, which model, which training run. An LIA that covers “model development” in general covers nothing in particular.
3. List the less intrusive alternatives, and record for each why it does not achieve the interest. Keep the rejected options in the document — they are the evidence that necessity was tested.
4. Assess reasonable expectations by reference to what the data subjects were actually told, quoting the notice text and its date rather than paraphrasing it.
5. List the impacts on data subjects, including the ones that count against you, and score them.
6. List mitigations against specific impacts, and re-score. A mitigation not tied to an impact is decoration.
7. Reach a conclusion in terms — that the interest is or is not overridden — and note that if it is overridden, the answer is to change the processing, not to soften the wording.
8. Record the Article 21 consequence: because the basis is 6(1)(f), data subjects can object under Article 21, and the document should say how an objection will be handled.
9. Date it, name the author, have the DPO review it where one is designated, and set a review point tied to the next training run rather than to a calendar.

One final point on scope. An LIA justifies a purpose, not a company. If the training data was collected for something else, the compatibility test in Article 6(4) has to be passed first, and that is a separate analysis set out on purpose limitation and reusing customer data. An LIA cannot repair a purpose limitation problem; it can only address the basis for a purpose you are entitled to pursue.