Cybersecurity Policy Report, Questionnaire on Legitimate Interests for Data Processing Offered in Germany, (Jan 6, 2026)
By Tony Foley
A comprehensive list of questions designed to determine legitimate interests for the processing of personal data was released today by the Hamburg State Commissioner for Data Protection and Freedom of Information (HmbBfDI).
HmbBfDI’s news release announcing the guidance said the document offered numerous examples and tips and could serve as a guide for authorities, companies, and organizations. It supports controllers in examining and documenting what their interest in data processing is and whether the rights and interests of the data subject are adequately considered. The questionnaire covers the most important points for controllers to consider, including the following:
Determination of legitimate interest: What are the goals of processing, and are they legally permissible?
Requirements: Is the processing necessary, and is the controller collecting required data only?
Balancing of interests: Are the rights and interests of data subjects sufficiently taken into account and protected?
Documentation and compliance: How is the audit recorded and regularly updated?
The questionnaire is available for download from the news release but is available only in German.
News: InternationalLegislation DataPrivacy