When can a small business use legitimate interests for an AI tool?

Only when three cumulative conditions are met: you pursue a legitimate interest, the processing is necessary for it, and the interests or fundamental rights and freedoms of the people concerned do not take precedence (GDPR Article 6(1)(f); EDPB Guidelines 1/2024). The EDPB says you should assess and document this before the processing starts.

Is telling people in the privacy notice enough to make it OK?

No. You must tell people which legitimate interests you pursue (Articles 13(1)(d) and 14(2)(b)), but the EDPB says that simply meeting the information duties is not in itself enough to conclude that people can reasonably expect the processing.

What counts as an extra safeguard in the balancing test?

Only measures that go beyond what the GDPR already requires. The EDPB gives examples such as letting people object without the limits of Article 21, or erase data even where Article 17(1) grounds do not apply. Security, data minimisation and transparency do not count, because you must do them anyway. After adding safeguards, run the balancing test again.

Using customer data in AI tools on 'legitimate interests': a three-step GDPR assessment sheet for small EU businesses (Article 6(1)(f))

Updated 22 Oct 2026 · Disclosure: the EURO AI Register mentioned below is an Unadhi product with a free edition. This guide is for information only, not legal advice.

What you get: a finished assessment sheet to fill in once per AI use, with ten rows: the AI use, the data, the three EDPB steps (interest, necessity, balancing with reasonable expectations), extra safeguards, the decision, the privacy-notice line to copy and a review date. Plus five common AI uses with a first view on each.

The short answer

You can use customer or staff data in an AI tool on the basis of legitimate interests only if three cumulative conditions are met: a legitimate interest, processing that is necessary for it, and no overriding interests or rights of the people concerned (GDPR Article 6(1)(f)). The EDPB says to assess and document this before you start, involve your DPO if you have one, and tell people which interest you rely on. If the balance goes against you and no extra safeguard fixes it, you need another legal basis or you should not do it.

The assessment sheet (one per AI use)

Row	What to write	Your answer
AI use and tool	[e.g. AI summaries and priority tags on support tickets in our helpdesk tool]. One sheet per use, not per tool.	[fill in]
Whose data and which data	[customers / prospects / staff]; [names, e-mails, ticket text]. Note anything sensitive or about children.	[fill in]
Step 1: the interest	Write it in one precise sentence. The EDPB test: lawful, clearly and precisely articulated, real and present (not speculative).	[fill in]
Step 2: necessity	Could you reach the same aim just as effectively with less data or a less intrusive method? Which fields can you drop or mask before they reach the tool? If a less intrusive way works, Article 6(1)(f) cannot be used for this processing.	[fill in]
Step 3a: impact	Nature of the data, context, possible consequences for the person (wrong scores, exclusion, data reaching the supplier).	[fill in]
Step 3b: reasonable expectations	Existing customer or not, where and how data was collected, the person's position. 'Common in our sector' is not the test.	[fill in]
Step 3c: extra safeguards	Only ones beyond GDPR duties, e.g. objection honoured without any balancing; outputs never used alone for decisions; shorter retention than needed. Then re-run 3a-3b.	[fill in]
Decision	Proceed / proceed with safeguards / stop or use another legal basis. Who decided, date, DPO involved if you have one.	[fill in]
Privacy-notice line	The interest in plain words plus the right to object (Articles 13(1)(d), 21(4)).	[fill in]
Review date	When the tool, the data or the purpose changes, and at least once a year.	[fill in]

Keep it short and honest. The EDPB says Article 6(1)(f) should not be chosen automatically because it looks less demanding than other legal bases, nor treated as a last resort. The duty is on you to show the balancing test was done properly, so a one-page sheet signed and dated beats a long template nobody reads.

Five common AI uses, a first view

AI use	First view (still do the sheet)
AI triage and summaries of incoming support tickets	Often arguable: faster answers to existing customers. Keep sensitive details out, check the supplier's retention, let people ask for a human.
AI fraud or abuse checks on orders or sign-ups	Recital 47 names fraud prevention as a legitimate interest, limited to what is strictly necessary. Note the logic and keep a human review path.
AI lead scoring of existing customers for offers	Possible, but direct marketing objections are absolute (Article 21(2)-(3)); offer an easy opt-out in every message.
Uploading your whole customer list to an AI tool to 'find insights'	Weak: the interest is vague and the data is not limited. Narrow the purpose and the fields first, or do not do it.
AI analysis of staff e-mails or productivity	High risk: the employer-employee imbalance weighs heavily. Get legal advice and check national employment rules and the EU AI Act duties for AI at work.

Copy this privacy-notice line

We use [tool] to [purpose, e.g. summarise and prioritise your support requests] because we have a legitimate interest in [answering requests faster]. We only send [data] to it, and [supplier] keeps it for [period]. You can object to this at any time by writing to [address]; for direct marketing we will always stop.

The right to object must be brought to people's attention clearly and separately from other information, at the latest at the first communication (Article 21(4)).

Do this week

List every AI tool that touches customer or staff data, with the legal basis you use for each
Fill one sheet for each use that relies on legitimate interests
Drop or mask any field the tool does not need
Add the interest and the right to object to your privacy notice
Put a review date in your calendar

This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 5, 6(1)(f), 13, 14 and 21, Recital 47) and EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, version 1.0 adopted 8 October 2024 for public consultation; check the EDPB website for any later version. National rules can add obligations. Checked on 22 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.

For accountants and tax advisers

Clients often say "we have a legitimate interest" without writing anything down. Walk them through one sheet for their main AI use next to their client AI inventory. Stay inside your professional rules and pass contested cases to a privacy professional or lawyer.

Keep the sheet next to your AI register

The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, and keep each signed sheet as an evidence record.

When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

Regulation (EU) 2016/679 (GDPR): Articles 5, 6(1)(f), 13, 14 and 21, Recital 47
EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, version 1.0 (PDF)
EDPB summary: legitimate interest, when and how to apply it (PDF)

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.