Data (Use and Access) Act 2025, section 70: recognised legitimate interests and the examples of legitimate interests (Data (Use and Access) Act 2025 c. 18, s 70 (new UK GDPR Art 6(5) and (11)))
The new fast-track basis (recognised legitimate interests) is limited to the listed conditions. Licensing records to an AI buyer is not among the examples either, so it stays under the ordinary three-part legitimate interests test.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“For the purposes of paragraph 1(ea), processing is necessary for the purposes of a recognised legitimate interest only if it meets a condition in Annex 1. ... For the purposes of paragraph 1(f), examples of types of processing that may be processing that is necessary for the purposes of a legitimate interest include- (a) processing that is necessary for the purposes of direct marketing, (b) intra-group transmission of personal data (whether relating to clients, employees or other individuals) where that is necessary for internal administrative purposes, and (c) processing that is necessary for the purposes of ensuring the security of network and information systems.”
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide