Legitimate Interest

Legitimate interest is the processing condition set out in Article 5(2)(f) of the Turkish Personal Data Protection Law No. 6698 (the “KVKK”). Under the Law, personal data may be processed without explicit consent where processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

In practice it is regarded as the most flexible processing condition. That flexibility, however, places the heaviest burden of proof on the data controller: a company relying on legitimate interest must be able to show, when required, what the interest is, why the processing is necessary and why the data subject’s rights do not override it.

The Three-Stage Assessment

In its decision dated 25.03.2019 and numbered 2019/78, the Personal Data Protection Board listed the criteria to be considered when relying on legitimate interest. Legal scholars and practitioners generally group these criteria into three stages:

1. Interest: The data controller must have a lawful, specific, clearly defined and existing interest. The thought that the data “might be useful in the future” or a general expectation of commercial benefit is not sufficient.
2. Necessity: The processing must be necessary to achieve that interest. If the same purpose can be achieved with less data or in a way that is less intrusive for the individual, this condition is not met.
3. Balancing: The data controller’s interest must be weighed against the fundamental rights and freedoms of the data subject. The individual’s reasonable expectations, the nature of the data, the possible impact of the processing on the individual and the security measures taken are decisive in this assessment.

The Law does not expressly require the assessment to be documented. However, given the principle of accountability and the possibility of a Board review, preparing a short assessment note for each reliance on legitimate interest is good practice.

Common Examples in Practice

Depending on the circumstances of each case, the following activities may be suitable for reliance on legitimate interest:

• Keeping access and activity logs on systems for information security purposes,
• Reviewing corporate accounts and records in internal audits and misconduct investigations,
• Sharing employee and contract data during due diligence in mergers and acquisitions,
• Processing the business contact details of contact persons at corporate customers and suppliers.

Limits and Common Mistakes

• Special categories of personal data: Legitimate interest is not among the exhaustively listed conditions for processing special categories of data under Article 6 of the KVKK. This remains the case after the amendment made by Law No. 7499, which entered into force on 1 June 2024. Data such as health data, biometric data or criminal convictions cannot be processed on the basis of legitimate interest.
• Commercial electronic messages: Marketing e-mails and text messages are also subject to Law No. 6563 and, as a rule, require the recipient’s prior approval. Legitimate interest cannot replace this approval.
• Combining it with consent: Asking the data subject for explicit consent where another processing condition already applies misleads the individual into thinking that the processing depends on their consent, and is treated as an abuse of rights in the Board’s practice.
• Transparency: Relying on legitimate interest does not remove the obligation to inform. The privacy notice must clearly state legitimate interest as the legal basis and explain what the interest is.

Comparison with the GDPR

The provision is similar to Article 6(1)(f) of the EU General Data Protection Regulation (GDPR). An important difference concerns the data subject’s right to object: while Article 21 of the GDPR grants a general right to object to processing based on legitimate interest, Article 11 of the KVKK contains no such general right. The data subject can still exercise their other rights, such as erasure, rectification and filing a complaint with the Board.