Privacy & Cybersecurity Law Blog

On March 23, 2026, the UK Information Commissioner's Office (the “ICO”) released new guidance clarifying the use of the new recognized legitimate interest lawful basis for processing personal information under UK data protection law. The new lawful basis was introduced in the UK Data (Use and Access) Act 2025 (“DUAA”) (see here). The ICO guidance aims to assist organizations in understanding the conditions and compliance requirements associated with handling personal data in situations where the recognized legitimate interest basis applies. 

The ICO’s new guidance draws a clear line between the new recognized legitimate interest lawful basis and the general legitimate interests lawful basis under the UK General Data Protection Regulation (“UK GDPR”). While the standard legitimate interests lawful basis is broader in scope, permitting organizations to define their own purposes for processing, subject to carrying out a comprehensive Legitimate Interests Assessment, recognized legitimate interest is reserved exclusively for five specific public interest scenarios listed in Annex 1 of the UK GDPR and introduced under the DUAA. Importantly, the recognized legitimate interest basis does not require that a Legitimate Interests Assessment be conducted.

As detailed further in the guidance, organizations may rely on the recognized legitimate interest basis where processing is necessary for specific scenarios:

• responding to disclosures requested by bodies performing public functions;
• safeguarding national security, public security or for defense reasons;
• responding to or dealing with emergency situations;
• preventing, detecting or investigating crimes; and
• safeguarding children or vulnerable adults from harm.

The guidance also sets out additional compliance requirements. Organizations must be transparent by notifying individuals when processing personal information in accordance with the recognized legitimate interest basis, including by specifying the relevant condition. The ICO also confirms that, as with legitimate interests, individuals have the right to object to processing when relying on the recognized legitimate interest basis. In addition, any new use of personal information must be compatible with the original purpose, and organizations are expected to uphold all data protection principles, including fairness, necessity and data minimization.

For further details, read the ICO's guidance here.