Legitimate Interests in B2B Marketing: UK GDPR Lawful Basis Explained

Consent isn’t the only route to compliant B2B marketing – and for most business-to-business outreach, it isn’t the right one. Here we look at legitimate interests as a lawful basis for processing personal data under UK GDPR, what the three-part test actually requires, and what changed when the Data (Use and Access) Act 2025 came into force.

Direct marketing can be a legitimate interest. It isn’t a “get out of jail free” card permitting you to use data however you want.

SO, WHAT IS THE ‘LEGITIMATE INTERESTS’ BASIS?

Article 6(1)(f) of the UK GDPR provides a lawful basis where processing is necessary for the purposes of the legitimate interests pursued by you or a third party – except where those interests are overridden by the interests or fundamental rights and freedoms of the individual whose data you’re processing.

Setting the legal language aside, the onus is on you to balance your legitimate interests and the need to process personal data against the interests, rights and freedoms of the individual. This differs from other lawful bases, which assume your interests and the individual’s are already balanced.

What the Data (Use and Access) Act 2025 changed. The DUAA received Royal Assent in June 2025, with most provisions taking effect from February 2026. Section 70 amended Article 6 to state explicitly that direct marketing is an example of processing that may be necessary for the purposes of a legitimate interest. That’s a helpful clarification – it puts on a statutory footing what most B2B marketers were already relying on.

It does not, however, make legitimate interests automatic. You still need to carry out and document the three-part test before you process. The statutory recognition strengthens your position; it doesn’t replace the assessment.

One point of confusion worth clearing up. The DUAA also introduced a separate lawful basis called recognised legitimate interests, which removes the need for a balancing test. This is not the same thing, and it does not apply to commercial marketing. It covers a defined list of public-interest purposes such as national security and safeguarding. If you’re marketing, you’re using the general legitimate interests basis under Article 6(1)(f), and the balancing test still applies.

If you’re a public authority, note that you can’t rely on legitimate interests for processing carried out in the performance of your public task.

The Information Commissioner’s Office sets out a three-part test to determine whether your processing falls within legitimate interests. Carry it out in this order:

1. Purpose test – is there a legitimate interest in your processing?
2. Necessity test – is the processing necessary for that purpose?
3. Balancing test – do the individual’s interests, rights or freedoms override that legitimate interest?

You must be able to meet all three parts before you start processing. Deciding it’s in your legitimate interests isn’t enough on its own.

PURPOSE TEST

The first step requires common sense. Ask whether what you’re pursuing is a legitimate interest. Direct marketing is recognised as one – now explicitly, in the legislation itself — but that doesn’t mean all direct marketing qualifies. If your marketing practices are unlawful or unethical, they won’t be a legitimate interest. Bad news for anyone making nuisance calls to flog sub-standard double glazing, or sending spam in breach of electronic marketing rules.

Be specific when you record your purpose. “Marketing our services” is weaker than “contacting facilities managers at UK NHS trusts about Legionella compliance obligations relevant to their role”. The more precisely you can state the interest, the easier the remaining two tests become.

NECESSITY TEST

The processing must be necessary to achieve your legitimate interest. Is it proportionate and adequately targeted to meet your specific goal? Could you achieve the same outcome by a less intrusive method? If you can, you don’t have legitimate grounds for using the personal data.

The ICO’s updated guidance is helpful here: necessity should be assessed as using personal information in a targeted and proportionate way, rather than as an absolute or unrealistically narrow threshold. You don’t have to prove there was no conceivable alternative – you have to show your approach was reasonable and not excessive.

In practice, that means collecting only what you genuinely need. We’ve all completed web forms asking far too many invasive questions. Gather only the personal data that’s truly essential to the marketing activity.

BALANCING TEST

Finally, do your legitimate interests outweigh the rights of the individuals whose data you’re using? You need to consider their interests, fundamental rights and freedoms – and satisfy yourself that these don’t override yours.

Proportionality is the deciding factor. An individual’s interests are likely to outweigh yours if you intend to use their data in ways they wouldn’t reasonably expect. Bombarding people with repeated calls, or contacting them in the middle of the night, would clearly be unreasonable.

Business-to-business marketing generally sits more comfortably here. Calling someone at work about a product or service relevant to their job role is relevant, appropriate, and broadly what a business contact would expect. That said, a named business email address – firstname.surname@company.co.uk – is still personal data, so UK GDPR applies even though PECR treats it as a corporate subscriber. The reasonable expectations of that individual still matter.

Document it. A Legitimate Interests Assessment is the record of your three-part test. It doesn’t need to be lengthy, but it does need to exist before you process, and it needs to be revisited when your campaign or audience changes. If the ICO asks how you reached your conclusion, the LIA is your answer.

THE RIGHT TO OBJECT

In direct marketing, an individual has an absolute right to object to their data being processed for that purpose. There’s no balancing exercise at this stage – if someone objects, you must stop processing their data for marketing immediately.

In practice, that means:

• Telemarketing – screen your data against the Telephone Preference Service (TPS) and Corporate
• Telephone Preference Service (CTPS) registers, and keep your own suppression record of anyone who has asked you to stop.
• Email marketing – include an unsubscribe link in every message, and make sure anyone who unsubscribes isn’t contacted again.
• All channels – identify yourself clearly, and tell people how their data will be used at the point you collect it.

Tighter rules apply to sole traders and partnerships, which PECR treats as individual rather than corporate subscribers. If either group is in your target market, that needs separate consideration.

The cost of getting this wrong has risen sharply. Before the DUAA, the maximum fine for a PECR breach was £500,000. It’s now the higher of £17.5 million or 4% of global annual turnover, in line with UK GDPR. The Act also extended PECR’s “soft opt-in” exemption to charities.

SUMMARY

Consent isn’t the only way forward for B2B marketing, and in most cases it isn’t the most practical one. Legitimate interests remains the workhorse basis for business-to-business outreach, and the DUAA has strengthened rather than weakened that position.

The rules haven’t fundamentally changed – but the consequences of ignoring them have. To stay on the right side of them:

• Use your common sense about what you’re doing and why
• Carry out the three-part test before you process, not afterwards
• Write up and file your Legitimate Interests Assessment
• Keep your suppression records and TPS/CTPS screening up to date
• Document your decisions, and review them when campaigns change

Follow those and you’ll be able to demonstrate compliance — which is, ultimately, what the regulator is looking for.

Getting this right is easier with the right partner.

At Blueberry, compliance isn’t an afterthought – it’s built into how we plan and run campaigns. We work with clean, compliant B2B data, screen against TPS and CTPS as standard, and maintain the records that demonstrate a lawful basis for every conversation we have on your behalf.

If you’d like to talk through how a compliant B2B lead generation or telemarketing campaign would work for your organisation, we’d be glad to help.

Talk to our team – call +44 (0)113 487 7013, email info@blueberryms.co.uk or complete our short contact form here.

You may also find our B2B data services and B2B telemarketing pages useful.

This article was originally published by Nathan Topping in June 2022 and updated by Angela Kunawicz in December 2022. It was reviewed and updated by Rebecca Charlesworth in August 2026 to reflect the Data (Use and Access) Act 2025.

This article is intended for guidance only and is not legal advice. The ICO’s direct marketing guidance is currently under review following the DUAA – for the current position, visit ico.org.uk.

.