Template Legitimate Interests Assessment (LIA)

Summary

This is a template Legitimate Interests Assessment (LIA) form published by the Jersey Office of the Information Commissioner (JOIC) to help organisations document and justify reliance on the legitimate interests lawful basis under the Data Protection (Jersey) Law 2018. It is a general-guidance tool that must be adapted to the specific processing activity and organisational context rather than a binding rule itself.

• Project and processing details: Record project name, responsible person, description of processing, categories of data and individuals affected, and whether special category data is involved.
• Purpose test: Identify whose legitimate interest is pursued, why the purpose is lawful and ethical, and whether individuals would reasonably expect the processing.
• Necessity test: Assess whether the processing is necessary, whether less intrusive alternatives or anonymisation/pseudonymisation exist, and why no other lawful basis is more appropriate.
• Balancing test: Evaluate risks to individuals, vulnerability, power imbalances, potential harm from misuse, and transparency measures.
• Safeguards: Document technical and organisational measures, how individuals can exercise rights (including the right to object), and retention/deletion arrangements.
• Outcome and sign-off: Summarise the purpose, necessity and balancing test outcomes, record a justified/not justified conclusion with any conditions, and obtain approver sign-off with a review date.

The template itself creates no statutory deadline or filing requirement; it is a self-assessment tool organisations use internally, ideally before relying on legitimate interests as their lawful basis for a given processing activity, and should be periodically reviewed.

Key obligations

• Organisations relying on legitimate interests as their lawful basis should complete a documented purpose test, necessity test and balancing test before processing personal data on that basis.
• Organisations should identify and record safeguards and mitigation measures (technical and organisational) and how individuals can exercise their right to object.
• Organisations should record an overall conclusion on whether processing is justified under legitimate interests, including any conditions to be met before processing begins.
• The assessment should be signed off by an approver and given a next review date.

Applies to

data controllers, organisations processing personal data under the Data Protection (Jersey) Law 2018