Hamburg data protection authority publishes questionnaire on legitimate interest assessments under the GDPR

The Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit, HmbBfDI) has published a comprehensive questionnaire to support organisations in conducting legitimate interest assessments under the General Data Protection Regulation (GDPR). The document is available with immediate effect and is intended as a practical guide for public authorities, companies, and other organisations.

The questionnaire is designed to help data controllers systematically examine and document whether their reliance on legitimate interest as a legal basis for processing personal data is justified. It provides structured guidance, practical examples, and explanatory notes to support compliance with Article 6(1)(f) GDPR.

Step by step, the document walks users through the key elements of a legitimate interest assessment. It first focuses on identifying the legitimate interest pursued, including clarifying the objectives of the processing and assessing whether those objectives are lawful. It then addresses necessity, prompting organisations to consider whether the processing is required for the stated purpose and whether only data that is strictly necessary is being collected.

A central part of the questionnaire is the balancing of interests, guiding controllers in evaluating whether the rights and interests of the data subjects are adequately taken into account and protected. The final section focuses on documentation and compliance, outlining how assessments should be recorded and kept up to date to demonstrate accountability.

According to the HmbBfDI, the questionnaire is intended to support consistent and transparent decision-making when relying on legitimate interest and to strengthen data protection compliance in practice. The legitimate interest assessment questionnaire can be downloaded from the authority’s website.