Legitimate Interest Assessment for AI

How to use this document

• Use it to document, before starting, whether legitimate interest can serve as the legal basis for training, fine-tuning or using an AI system with personal data, applying the three-step test: purpose, necessity and balancing.
• Suggested owners: the data protection officer (DPO) or privacy function, with legal. The AI project owner and the data team provide the technical description and the measures.
• Before adopting it, decide who signs the assessment, which result means another legal basis must be found and how the right to object will be handled.
• Complete one assessment per processing activity and per phase. Training a model and using it in production are different phases and may produce different results.
• If the processing includes sensitive data, legitimate interest alone is not enough: review section 7 before continuing.
• If the assessment concludes that legitimate interest is not valid, file it anyway and document the alternative basis or the decision not to process.
• Keep only the variants for the countries where the processing takes place and delete the rest.
• Ask internal legal or an outside advisor to review the assessment, especially the balancing and the mitigation measures, and have the DPO give a written opinion.
• Approve the assessment with the signature of a person with authority over the processing, keep it under version control and link it to the record of processing activities and, if there is one, to the impact assessment.

Legitimate Interest Assessment for AI

Field	Content
Organization	[LEGAL ENTITY NAME] ([ORGANIZATION NAME])
Processing assessed	[COMPLETE]
AI system	[AI SYSTEM]
Phase	Development (training or fine-tuning) / Deployment (production use) / Both
Model or service provider	[VENDOR]
Processing owner	[OWNER]
Function	[RESPONSIBLE FUNCTION]
Countries	[COUNTRY]
Reference in the record of processing activities	[COMPLETE]
Linked impact assessment	[COMPLETE] / Not applicable
Version and date	[COMPLETE] / [DATE]
Privacy contact	[PRIVACY EMAIL]

1. Purpose and scope

1.1. [ORGANIZATION NAME] carries out this assessment to decide, and record, whether its legitimate interest, or that of a third party, allows personal data to be processed in the activity described without the interests, rights and freedoms of the people affected overriding it.

1.2. The assessment is completed before processing starts and reviewed when the purpose, data, sources, model or context of use change.

1.3. Each phase of the AI system lifecycle is assessed separately when its characteristics differ: data collection, training or fine-tuning, evaluation, deployment and continuous improvement with usage data.

2. Description of the processing

Element	Description
Specific purpose	[COMPLETE: for example, "train a model that detects fraudulent card payment transactions"]
AI system functions	[COMPLETE]
Categories of personal data	[COMPLETE]
Data sources	Provided by individuals / Generated by the relationship / Obtained from third parties / Collected from public internet sources / Other: [COMPLETE]
People affected	Customers / Users / Staff / Candidates / General public / Other: [COMPLETE]
Are children or vulnerable people involved?	Yes / No / Cannot be ruled out
Approximate volume	[COMPLETE: people and records]
Retention	[COMPLETE]
Recipients and vendors	[COMPLETE]
International transfers	Yes / No. File: [COMPLETE]
Can the resulting model contain personal data?	Yes / No / To be checked (see section 6)