Germany: Hamburg Commissioner for Data Protection and Freedom of Information published questionnaire to determine legitimate interest under General Data Protection Regulation

On 6 January 2026, the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) released a questionnaire for the three-step test to determine legitimate interest pursuant to Article 6(1)(f) General Data Protection Regulation (GDPR). The questionnaire states that, before commencing planned processing based on legitimate interest, controllers must examine and document whether all three prerequisites are jointly fulfilled. The questionnaire sets out the three-step legitimate interest assessment, comprised of legitimate interest, necessity, and balancing of interests. Further, the questionnaire outlines the data controller's documentation and compliance requirements.