# The Legitimate-Interest Read for Cold Outreach: Rely, Mitigate, or Not

*You can run the three-part legitimate interest test on one named sourcing purpose, land a defensible verdict, and produce an LIA record that survives an audit or objection.*

- Canonical URL: https://www.refolk.ai/guides/legitimate-interest-read-cold-outreach
- Pillar: Process, data, and compliance
- Format: Framework
- Published: 2026-10-11
- Last reviewed: 2026-10-11
- Reading time: 18 min
- Keywords: legitimate interest assessment template, legitimate interest cold email, gdpr legitimate interest recruitment, three part test legitimate interest, lawful basis sourcing candidates, balancing test direct marketing

## Key takeaways

- The balancing test is where sourcing campaigns die, not the purpose test: LinkedIn cleared purpose and necessity and still lost EUR 310 million on balancing alone.
- A legitimate interest does not survive bad means: CNIL accepted Amazon France Logistique's interest and still fined it EUR 32 million because the processing was disproportionate.
- PECR is a gate, not a factor. If your first-contact channel requires consent, no amount of balancing-test mitigation makes legitimate interests available.
- The DUAA 2025 'recognised legitimate interests' basis that skips the balancing test explicitly excludes commercial activity, so outbound sourcing stays on the full three-part test indefinitely.
- The LIA must be dated and completed before processing begins; an assessment written after first contact is void regardless of its conclusion.
- In Refolk's index of professional profiles, there are roughly 1.14 sourcer-side roles per Data Protection Officer across the UK and Germany, so the LIA must be usable by the sourcer at the desk.

Before I cold-contact a sourced candidate or prospect, I have to decide one thing: is legitimate interest a defensible lawful basis for this specific outreach, and can I prove I decided it on purpose? This guide is for the sourcer running the campaign and the recruiting or revenue operations owner answerable for how the data was gathered. It gives you a scored three-part test you can run on one named sourcing purpose, the mitigations that flip a borderline result to a pass, and a go/no-go verdict tied to that campaign and recorded in a way that holds up to an audit or a data subject objection.

The pages that rank for "legitimate interest assessment template" are generic legal checklists or vendor summaries. None of them scores the test against the actual workflow of outbound sourcing, and most predate both the EDPB Guidelines 1/2024 and the UK Data (Use and Access) Act 2025. This one does.

## What the three-part test actually asks

Legitimate interest is a three-part test, and all three parts must pass for the basis to hold. ICO frames it as the purpose test (are you pursuing a legitimate interest?), the necessity test (is your use of personal information necessary for that purpose?), and the balancing test (do the person's interests override your interest?). The EDPB aligns: first the pursuit of a legitimate interest, second the need to process for that interest, third that the data subject's interests or fundamental rights do not take precedence.

The three conditions are cumulative. Fail one and the basis fails. That sounds obvious, but it is the source of the two most expensive mistakes in this field, and I will come back to both.

Two definitions matter before you start. The EDPB says an interest qualifies only where it is "lawful, precisely articulated and present." That rules out "recruitment generally" as a purpose - the interest has to be specific enough to assess. And "necessary" does not mean "no alternative exists." It means proportionate and targeted: you ask whether there is a less intrusive, reasonably available way to achieve the same aim.

#### The three-part test, in order

1. **PECR gate** - Does the first-contact channel require consent? If yes, legitimate interest is off the table.
2. **Purpose test** - Is the interest lawful, precisely articulated, and present?
3. **Necessity test** - Is the processing proportionate, with no less intrusive route available?
4. **Balancing test** - Do the data subject's rights and expectations override your interest?

*All three conditions are cumulative; the PECR gate sits before the test because it can remove legitimate interest entirely.*

### What changed, and why the old checklists are stale

The EDPB adopted Guidelines 1/2024 on Article 6(1)(f) on 8 October 2024, Version 1.0. They push a restrictive interpretation: Article 6(1)(f) should not be treated as a "last resort" nor automatically chosen because it feels less constraining than other bases. The timing rule is the one that bites. Controllers should assess and document whether the three cumulative conditions are met, and that assessment should be done before carrying out the processing. An LIA written after you started sending is not an LIA. It is a reconstruction, and it fails.

**Before - When the LIA must be completed, relative to first processing**

ICO and EDPB both require the three-part assessment to be documented before the relevant processing operations begin.

## PECR is a gate, not a factor

Decide the PECR question before you run the test, because it can make the whole test moot. ICO is explicit: if PECR require consent, you must not use legitimate interests as your lawful basis for that purpose, because PECR limit which basis is available. And if PECR require consent, you must use consent; otherwise the processing is unlawful, and legitimate interests cannot legitimise unlawful processing.

This outranks everything that follows. The Privacy and Electronic Communications Regulations govern electronic direct marketing - email, SMS, automated calls. Whether consent is required turns on the channel and on whether the recipient is a corporate or individual subscriber. If your first contact is a cold email that PECR says needs consent, no balancing-test mitigation rescues it. The channel decision comes first and it is binary.

> **Rule:** Run the PECR gate before you score anything
>
> Confirm the first-contact channel and whether the recipient is a corporate or individual subscriber before you run the three-part test. If PECR requires consent for that channel, legitimate interest is unavailable and the rest of the assessment is wasted effort.

The practical consequence: a channel that clears PECR, like a connection message on a professional platform where the person reasonably expects recruiter contact, leaves legitimate interest in play. A cold personal-email blast to individuals usually does not. Document the PECR outcome per channel before you go further.

## Where campaigns actually die: the regulator record

The balancing test, not the purpose test, is where sourcing campaigns die. The two cases every ops owner should know by heart are LinkedIn and Amazon France Logistique, and they fail on different parts of the test. That is the whole lesson.

The Irish Data Protection Commission fined LinkedIn EUR 310 million, decision notified 22 October 2024 by Commissioners Des Hogan and Dale Sunderland. The DPC found LinkedIn did not validly rely on Article 6(1)(f) for behavioural analysis and targeted advertising because its interests were overridden by users' fundamental rights and freedoms. The mechanics matter: LinkedIn met the first two criteria - advertising effectiveness as the interest and necessity - but failed the third, because its interests did not override users' rights, given that its practices could lead to inappropriate targeting or exclusion based on inferred data.

The CNIL fined Amazon France Logistique EUR 32 million, deliberation SAN-2023-021 of 27 December 2023. CNIL accepted the interest but rejected the means: three monitoring indicators could not rest on legitimate interest because they led to excessive monitoring exceeding the objective pursued. The interest was fine. The processing was disproportionate.

| Case | Fine | Which test failed |
|---|---|---|
| LinkedIn (DPC, 2024) | EUR 310m | Balancing (passed purpose and necessity) |
| Amazon France Logistique (CNIL, 2023) | EUR 32m | Necessity and proportionality (interest accepted) |

Read the two together. LinkedIn teaches that passing purpose and necessity proves nothing about whether you survive. Amazon teaches that a legitimate purpose does not survive excessive means. Between them they cover both ways a sourcing LIA fails after the easy part is done.

> A defensible interest plus excessive data still fails. Legitimacy of purpose does not survive bad means.

## Scoring each test for a sourcing campaign

Score each test against your one named campaign and let the lowest score set your verdict. I use three bands per test: pass, borderline, fail. The purpose test is usually easy for sourcing - you have a real interest in finding and contacting qualified people. Spend your effort on necessity and, above all, balancing.

### Purpose: pass unless the interest is vague or unlawful

The purpose passes when you can name the interest in one sentence and point to who benefits. It is borderline when the interest is real but loosely stated ("building a pipeline"). It fails when the interest is unlawful or so generic it cannot be assessed. For sourcing, the honest framing is "contacting named individuals whose public professional profile matches an open role, to offer that specific opportunity." That is lawful, precise, and present.

### Necessity: pass only when you have named a rejected alternative

Necessity passes when the processing is the proportionate, targeted route and you can name a less intrusive option you considered and rejected with a reason. It is borderline when you collected more than you need "to be safe." It fails when you cannot point to any alternative you weighed - which usually means you did not run the test at all, you asserted it. The Amazon trap lives here: volume and retention are the trigger. If you are keeping every field you can scrape rather than the minimum for first contact, that is a necessity failure in waiting. The ICO's AI recruitment audit found tools that collected far more personal information than necessary and retained it indefinitely to build databases without candidates' knowledge, including data scraped from social and job networking sites.

### Balancing: the test you must actually argue

Balancing passes when the data subject would reasonably expect this contact, the intrusion is low, and the source is appropriate. It is borderline when expectation is plausible but the source or intrusion is questionable. It fails when the person would be surprised or would likely object. Three inputs drive it: reasonable expectations, intrusiveness, and the data source.

The data source is where sourcers lose. ICO draft recruitment guidance says to avoid searching for candidates on their personal social media profiles even when public, because such processing is intrusive, high risk, and not likely to reveal relevant information. Manually searching recruitment-based platforms may be acceptable, because candidates reasonably expect it. So "it is public, therefore expected" is backwards. Reasonable expectation, not accessibility, governs the balance, and scraping a public personal profile weakens the LIA rather than strengthening it.

> **Watch out:** Public does not mean expected
>
> Treating a public profile as fair game is the costliest false assumption in a sourcing LIA. ICO treats searching personal social profiles as intrusive and high risk regardless of the privacy setting. Source from platforms where the person expects recruiter contact, and record why the source fits the expectation.

#### The balancing read for a sourcing source

Horizontal axis runs from Low intrusion to High intrusion. Vertical axis runs from Low expectation of contact to High expectation of contact.

| Quadrant | What it means |
| --- | --- |
| Personal profile, cold channel | Do not rely; this is the LinkedIn-style balancing failure. |
| Recruitment platform, cold channel | Rely with mitigations; add notice and opt-out, record the source fit. |
| Personal profile, scraped detail | Do not rely; intrusive source plus low expectation fails hardest. |
| Recruitment platform, targeted contact | Rely; strongest position, still log the mitigations. |

*Place your source and intrusion on the grid, then read the action off the quadrant.*

## The mitigations that flip a borderline balance

Four mitigations move a borderline balancing result to a pass, and each must be logged against the score it changed. ICO says direct marketing under legitimate interests must be proportionate, have minimal privacy impact, and not surprise people or be something they are likely to object to. The mitigations exist to satisfy exactly those tests.

| Mitigation | What it fixes | Evidence it is in place |
|---|---|---|
| First-contact opt-out notice | Surprise and lack of choice | Opt-out present in the first message, not buried later |
| Data minimisation | Intrusion and necessity | Only fields needed for the specific offer are held |
| Suppression list | Repeat contact after objection | Objectors blocked before the next send |
| Short retention clock | Proportionality over time | A dated deletion rule tied to campaign end |

The notice rule is specific. ICO says to give people a clear choice to opt out of direct marketing when you initially collect their details, or when you communicate for the first time if you did not collect the details directly from them. Since sourcing almost always means you did not collect the details directly, the opt-out belongs in the first message. Buried-later notice is a documented failure mode.

Log each mitigation against the score it moved. A balancing test that reads "low impact" in every box with no mitigation trail is the reverse-engineered LIA regulators see through.

I ran this search: `Data protection officers at UK fintech companies with 200 to 1,000 employees.` - [see the full result list](https://www.refolk.ai/s/tv5zz046fb).

*Returns named DPOs at mid-market UK fintechs, so the ops owner can route a borderline LIA to the person actually answerable for the sign-off.*

I built [Refolk](/) so the sourcer at the desk can find the right contacts and the right reviewer in plain English, which matters because the people who own this sign-off are thin on the ground. In Refolk's index of professional profiles there are roughly 1.14 sourcer-side roles for every Data Protection Officer across the UK and Germany. At that ratio, per-contact legal review is not an option, and the scored test has to be runnable by the person doing the sourcing.

## The DUAA 2025 question, and why it does not help sourcers

The DUAA 2025 adds a no-balancing-test basis, but it does not cover sourcing. Section 70 inserted a new Article 6(1)(ea) and Annex 1 into the UK GDPR, and a controller processing for a recognised legitimate interest does not need to carry out the three-step balancing test. That sounds like a shortcut. It is not one for you.

The scope is deliberately narrow. Eligible purposes include protecting public security, detecting or preventing crime, and safeguarding vulnerable individuals. Recognised legitimate interests do not extend to commercial processing. Marketing stays on the standard basis - most businesses will still use standard legitimate interests for commercial activity, which continues to require a full balancing assessment. Parliament pre-weighted only public-interest categories, so outbound candidate and prospect sourcing stays on the full three-part test indefinitely.

The key provisions come into force from 5 February 2026 under SI 2026/82: Article 6(1)(ea) and Annex 1, the recast automated-decision-making Articles 22A to 22D, and a new Article 12A that changes how the one-month DSAR period is calculated. A new s.164A DPA 2018 adds a complaints regime with a 30-day acknowledgment, in force from 19 June 2026. Tagging a sourcing campaign as a "recognised legitimate interest" to skip the balancing test is the DUAA over-claim failure mode, and it is a clean way to lose a case.

> **Note:** Re-check the dates against commencement
>
> The DUAA provisions commence on fixed dates in 2026. The GDPR Article 12(3) one-month response standard for objection and erasure is established law; confirm the exact calculation against the new Article 12A once it is in force for any contact made after 5 February 2026.

## The procedure: run it on one named campaign

Run these eight steps on one named sourcing purpose and record the result before you contact anyone. Each step names an owner and a rough duration so you can plan it into a campaign kickoff rather than bolting it on afterward.

#### From named purpose to dated LIA record

1. **Define one named sourcing purpose** - State the precise campaign, channel, and audience in one sentence. Done when the interest is lawful, precisely articulated, and present - not "recruitment generally". Owner: ops owner or DPO, around 30 minutes.
2. **Run the purpose test** - Confirm the interest is legitimate and lawful and does not breach other rules. Done when you can articulate who benefits and how, in writing. Owner: sourcer plus ops, around 30 minutes.
3. **Gate against PECR first** - If first contact is by email, SMS, or automated call and PECR demands consent, stop - legitimate interest is unavailable. Done when the PECR outcome is documented per channel. Owner: DPO, around 20 minutes.
4. **Run the necessity test** - Show the processing is proportionate and that no less intrusive route achieves the aim. Done when the rejected alternatives are recorded by name. Owner: ops, around 30 minutes.
5. **Run the balancing test** - Weigh reasonable expectations, intrusiveness, and data source. Done when you have a reasoned verdict, not a conclusion reverse-engineered to pass. Owner: DPO plus ops, one to two hours.
6. **Apply mitigations and re-score** - Add first-contact notice, opt-out, suppression list, and minimisation. Done when borderline scores move to pass with each mitigation logged. Owner: ops, around one hour.
7. **Record the LIA and land the verdict** - Verdict is rely, rely-with-mitigations, or do not rely. Done when a dated record is completed before processing starts. Owner: DPO, around 30 minutes.
8. **Wire in objection and erasure handling** - Done when a documented workflow meets statutory response windows and treats the marketing objection as absolute. Owner: ops, ongoing.

The verdict is one of three. Rely means all three tests pass without mitigation. Rely-with-mitigations means a borderline balancing result was moved to a pass by logged mitigations, and you may proceed only with those mitigations live. Do not rely means a test fails and no mitigation fixes it - the PECR gate failing is the clearest case, but an irredeemable balancing failure counts too.

**LIA record skeleton for one sourcing campaign**

```
Campaign name:
Date of this assessment (must precede first processing):
Owner / DPO sign-off:
Named purpose (one sentence):
PECR gate: channel = ___ ; subscriber type = ___ ; consent required? Y/N ; outcome:
Purpose test: PASS / BORDERLINE / FAIL - reasoning:
Necessity test: PASS / BORDERLINE / FAIL - rejected less-intrusive alternative:
Balancing test: PASS / BORDERLINE / FAIL - expectations / intrusion / source:
Mitigations applied (one line each, linked to the score moved):
  - first-contact opt-out:
  - data minimisation:
  - suppression list:
  - retention clock:
Verdict: RELY / RELY-WITH-MITIGATIONS / DO NOT RELY
Objection and erasure workflow reference:
```

*Fill every field before first contact. Keep the dated file; it is your defence against an audit or objection.*

## How this goes wrong: the failure modes

Most LIAs fail in predictable ways, and each has a cheap check that catches it. Treat this as the part of the standard you reread before every campaign.

- **PECR skipped.** The LIA "passes" but first contact is a cold email requiring consent, so the pass is void. Check: confirm channel and corporate-versus-individual subscriber before you score anything.
- **Reverse-engineered balancing.** The LIA reads like advocacy and every box says "low impact." Check: is there a named, rejected, less-intrusive alternative? If not, the necessity test was not actually run.
- **The LinkedIn trap.** "We passed purpose and necessity, so we are safe." Those two can pass while the balancing test fails, which is exactly how LinkedIn lost EUR 310 million. Check: stress-test reasonable expectations and inferred-data harms separately, not as an afterthought.
- **The Amazon trap.** The business justification is treated as decisive and the data volume is ignored. Check: is the data volume and retention the minimum for the stated aim, or are you keeping "every detail"?
- **"Public means expected."** A public profile is assumed fair game. Check: ICO treats personal-profile searching as intrusive and high risk regardless of the setting, so the source weakens the balance.
- **Opt-out offered too late.** The notice is buried after first contact. Check: is the opt-out present in the first communication, as ICO requires?
- **DUAA over-claimed.** Sourcing is tagged "recognised legitimate interest" to skip balancing. Check: recognised legitimate interests exclude commercial purposes, so the full balancing test still applies.
- **Stale LIA.** The record is written after processing started. Check: the LIA date must precede the first processing date.

#### Before you call the LIA done

- [ ] The PECR gate is documented per channel and subscriber type, and the channel does not require consent.
- [ ] The named purpose is one specific sentence, not "recruitment generally".
- [ ] The necessity test names a less-intrusive alternative that was considered and rejected.
- [ ] The balancing test scores expectations, intrusiveness, and source separately, with reasoning.
- [ ] Every mitigation is logged against the specific score it moved from borderline to pass.
- [ ] The data source is one the person reasonably expects, not a scraped personal profile.
- [ ] The opt-out appears in the first communication, not later.
- [ ] The LIA is dated and the date precedes the first processing of any contact.
- [ ] An objection and erasure workflow exists and treats the marketing objection as absolute.

## The population reality, and keeping the read current

The reason this has to be a scored desk-level read, not a central legal gate, is scale. Review cannot sit with a handful of specialists per contact when the sourcing population dwarfs the oversight population.

| Market | People in index | Index vs UK (derived) |
|---|---|---|
| United States | 116,515 | 15.3x |
| United Kingdom | 7,629 | 1.0x |

In Refolk's index of professional profiles, recruiter and sourcer-type roles number 116,515 in the US against 7,629 in the UK - the US pool is 15.3 times the UK's. Across the UK and Germany the index shows 1,090 sourcer-side roles against 953 Data Protection Officers, a near one-to-one split that makes centralised per-contact review impossible. The framework has to live at the sourcer's desk, with the DPO owning the sign-off and the escalations.

| Role group | People in index | Share of combined (derived) |
|---|---|---|
| Sourcer-side roles | 1,090 | 53.4% |
| Data Protection Officers | 953 | 46.6% |

To keep the read current, track three moving parts. First, the DUAA commencement dates: the core provisions land on 5 February 2026 and the complaints regime on 19 June 2026, so re-check your objection and DSAR timing against the new Article 12A after those dates. Second, ICO recruitment guidance, which was in draft and consulted on through early 2024 and should be checked for its final form before you lean on the social-profile position. Third, your own channel mix: any new outbound channel means a fresh PECR gate, because the gate is per channel and it outranks everything downstream of it. Re-run the eight steps for each distinct campaign; an LIA is a record of one named purpose, not a standing permission.

## Frequently asked questions

### Can I rely on legitimate interest for a cold recruitment email?

Only if PECR does not require consent for that channel and contact type. ICO is explicit that where PECR require consent you must use consent, and legitimate interests cannot legitimise unlawful processing. So decide the PECR question per channel first. If the first-contact email clears PECR, you then still need a full three-part legitimate interest test with the balancing test documented before you send.

### Does the DUAA 2025 let me skip the balancing test for sourcing?

No. The DUAA inserted a new Article 6(1)(ea) and Annex 1 of recognised legitimate interests that do not require the three-step balancing test, but these cover public-interest categories such as crime prevention and safeguarding. They explicitly exclude commercial activities such as marketing. Outbound candidate and prospect sourcing stays on standard legitimate interests, which continues to require a full balancing assessment.

### When does the LIA have to be written?

Before processing begins. ICO requires the three-part assessment to be done before the relevant processing operations, and EDPB Guidelines 1/2024, adopted 8 October 2024, say controllers should assess and document the three cumulative conditions before carrying out processing. A record written after first contact is a stale LIA and fails on timing, no matter how strong its reasoning.

### Is sourcing from public LinkedIn or social profiles safe because the data is public?

No. ICO draft recruitment guidance says to avoid searching candidates' personal social media profiles even when public, because such processing is intrusive and high risk. Reasonable expectation, not accessibility, governs the balancing test. Manually searching recruitment-based platforms, where candidates reasonably expect to be found, is more defensible. Treat 'public means expected' as the costliest false assumption in a sourcing LIA.

### What mitigations flip a borderline balancing test to a pass?

A clear first-contact opt-out, data minimisation, a suppression list, and a short retention clock. ICO says direct marketing under legitimate interests must be proportionate, have minimal privacy impact, and not surprise people. Give a clear opt-out when you first communicate if you did not collect the details directly. Log each mitigation against the specific score it changed so the record shows the work, not just the conclusion.

### How fast do I have to respond to an objection?

The right to object to direct marketing is absolute, so you must stop on request. For the response window, the GDPR Article 12(3) one-month standard applies to objection and erasure. The DUAA introduces a new Article 12A changing how the one-month period is calculated and a complaints regime with a 30-day acknowledgment under new s.164A DPA 2018, in force from 2026. Confirm the exact calculation against Article 12A for your contact date.

---

*From the Refolk guide library. I revise these guides rather than replacing them, so the current version is always at https://www.refolk.ai/guides/legitimate-interest-read-cold-outreach*