EDPB Guidelines 1/2024 on legitimate interest, paras 59 and 60: the burden and the fallback (EDPB Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, Version 1.0, adopted 8 October 2024 (public consultation version), paras 59-60)
The holder carries the burden of proof, and if the balance fails even after safeguards, legitimate interests is simply unavailable. The EDPB page still lists only Version 1.0, issued for public consultation, on 18 October 2026, so treat them as a draft position.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“The duty is upon the controller to demonstrate that the balancing test has been conducted appropriately and that the legitimate interest(s) being pursued are not objectively overridden by the data subject's interests, fundamental rights and freedoms. ... If the data subject's interests, rights and freedoms override the legitimate interests being pursued, and no sufficient mitigating measures can be taken, the processing cannot be based on Article 6(1)(f) GDPR.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide