Hamburg Commissioner for Data Protection and Freedom of Information: questionnaire on balancing of interests under the GDPR

On January 8, 2026, the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) published a questionnaire on determining legitimate interest under the GDPR. The guidance is intended to assist controllers and data protection officers in systematically assessing the requirements of the legal basis of legitimate interest under Article 6(1)(f) of the GDPR and in documenting the relevant considerations of the balancing of interests in a comprehensible manner. The guidance thus provides a helpful framework for the practical implementation of this legal basis and creates legal certainty regarding supervisory authorities’ assessment criteria.

The key message is: A balancing of interests must not be carried out in a blanket manner, but must be systematically assessed and documented. To this end, the supervisory authority provides for a three-stage assessment:

• In the first step, it must be clarified whether a legitimate interest exists at all. This may take various forms, such as legal, economic or non-material in nature. It is crucial that the specific interest being pursued is clearly identified, along with the party from whom it originates, and that this interest is legally permissible, sufficiently specific and actually exists.
• The second step then concerns the necessity of the data processing. It must be examined whether the purpose cannot also be achieved with less data or by less intrusive means. Data minimisation is important: only as much data as is strictly necessary may be processed. Aspects such as the storage period and data flows are also relevant at this stage.
• The third step involves the actual balancing of interests. At this stage, the legitimate interest is weighed against the interests and rights of the data subjects, and it is examined whether the legitimate interest is thereby overridden. Among other things, the sensitivity of the data, the data subjects and possible impacts, as well as protective measures, are taken into account.

The HmbBfDI emphasises that it is not always necessary to answer every question in the checklist in detail and down to the smallest detail. Rather, the specific individual case is decisive: depending on the complexity and sensitivity of the processing, an in-depth examination of individual points may be appropriate; in less critical situations, a more pragmatic, risk-oriented approach with a reduced scope of documentation is recommended.

We would be happy to assist you in carrying out a balancing of interests in individual cases with the appropriate level of detail, examining critical points in a targeted manner and developing a solution that both meets legal and regulatory requirements and remains manageable in practice.

May 26, 2026