Cybersecurity Policy Report, U.K.’s ICO Updates Guidance on Legitimate Interests for Processing, Reuse of Information, (Mar 24, 2026)

By Tony Foley

Guidance documents on the use of a legitimate interests legal basis for the processing of personal data and on when it is compatible to reuse personal information in line with the purpose limitation principle under data protection law have been updated by the United Kingdom’s Information Commissioner’s Office (ICO).

Recognized legitimate interests legal basis. The ICO’s guide to legal basis was updated yesterday to revise the agency’s guidance on recognized legitimate interest. The guidance specifies that the recognized legitimate interests basis differs from the legitimate interests lawful basis because it has five conditions containing pre-approved purposes that are in the public interest, covering situations like crime prevention, public security, national security or defense, and emergencies, among others. For these purposes, controllers are not required to assess whether a person’s rights, freedoms, or interests outweigh the recognized legitimate interest, but they must consider whether what they wish to do is necessary.

Controllers wishing to use the recognized legitimate purpose basis must be clear about the purpose of processing, because it may only be used for the pre-approved purposes listed in its five conditions under the U.K.’s General Data Protection Regulation (GDPR). These conditions include the following:

1. Public task disclosure, for when controllers want to voluntarily share personal information in response to a request from another organization that needs it for their public tasks or official functions (which differs from a legal obligation lawful basis for processing);

2. National security, public security, and defense condition;

3. Emergencies;

4. Crime; and

5. Safeguarding.

The guidance specifies precise parameters within which each condition must be met to justify the recognized legitimate interests basis.

Reuse of personal information. The ICO’s guidance on compatibility and the reuse of personal information explains that reuse occurs when a controller uses personal information for a purpose other than that for which it was originally collected. ICO acknowledges that personal information may be used for a different purpose but only when it is compatible with the original purpose. The U.K. GDPR specifies several circumstances in which reuse is compatible with the original use, but if none of them are met, controllers must conduct a compatibility assessment, in which the controller must consider several factors, including any link between the original purpose and new purpose, the context in which the information was collected, the nature of the processing and whether it involves special category data or criminal defense data, the possible consequences for people of what the controller intends to do with the reused information, and the existence of appropriate safeguards like encryption or pseudonymization. Finally, any previously collected personal information reused for a new purpose must identify a legal basis for such processing. The original lawful basis may be found to be sufficient under some circumstances for the new purpose, but if not, a new legal basis must be identified.

News: InternationalLegislation DataPrivacy DataSecurity GDPR