The Information Commissioner (ICO) has launched a consultation on draft guidance about the new lawful basis of ‘recognised legitimate interest’, introduced by the Data (Use and Access) Act 2025.

The new lawful basis is distinct from and separate to the existing basis of ‘legitimate interests’, which asks whether the legitimate interest pursued when handling personal information is necessary and overrides the data subject’s interests, rights or freedom.

The important difference in the recognised legitimate interest basis lies in the fact that there is there is no need to engage in the balancing exercise of weighing up the interest pursued against a person’s rights, freedom or interests. That is because, in effect, that work has already been done since the new law introduces a series of ‘pre-approved’ purposes which are deemed to be in the public interest. These are set out in Annex 1 of the UK GDPR, and involve the need to use personal information to:

1. share it with another organisation that has requested it from you because they need it for their public task or official functions (the ‘public task disclosure request condition’);
2. safeguard national security, protect public security or for defence reasons (the ‘national security, public security and defence condition’);
3. respond to, or deal with, an emergency situation (the ‘emergencies condition’);
4. prevent, detect or investigate crimes, including the apprehension and prosecution of offenders (the ‘crime condition’); or
5. protect the physical, mental or emotional well-being of people who need extra support to do this or protect them from harm or neglect (the ‘safeguarding condition’).

Each of these conditions is unpacked in detail in the draft guidance, as the ICO sets out when each is likely to be appropriate and how it should be applied.

The draft guidance also makes clear that, although the introduction of this new lawful basis is intended to give organisations greater confidence and flexibility when handling personal information for one of the pre-approved purposes, use of the information must nonetheless still be necessary for the purpose pursued. It also reminds organisations that the new basis is not an exemption: other provisions of data protection law will still apply, including transparency obligations.

The consultation on the draft guidance closes on 30 October 2025 and can be read in full here.