LEGITIMATE INTEREST ASSESSMENT (LIA) TEMPLATE

LEGITIMATE INTEREST ASSESSMENT (LIA) TEMPLATE
Prepared for Northgate Telecommunications PLC
DOCUMENT CONTROL
DISTRIBUTION LIST
Right-click to update Table of Contents
SECTION 1: INTRODUCTION AND PURPOSE
1.1 Purpose of This Template
This template provides a standardised framework for conducting Legitimate Interest Assessments ("LIAs") under Article 6(1)(f) of the UK General Data Protection Regulation (the "UK GDPR") and the General Data Protection Regulation (EU) 2016/679 (the "EU GDPR"). The template is intended to ensure that all processing activities undertaken by Northgate Telecommunications PLC ("NTP") and its group entities that rely upon legitimate interest as their lawful basis are assessed in a rigorous, consistent, and fully documented manner, in accordance with the accountability principle set out in Article 5(2) of the GDPR.
This template has been designed for use by NTP and the following wholly owned subsidiaries (together, the "NTP Group"):
•  Northgate Telecommunications PLC (United Kingdom);
•  Northgate Ireland Ltd (Republic of Ireland);
•  Northgate GmbH (Germany);
•  Northgate B.V. (the Netherlands);
•  Northgate France SAS (France); and
•  Northgate Iberia S.L. (Spain).
The template is applicable across all UK and EU operations of the NTP Group. Each entity within the NTP Group that acts as a data controller in respect of a processing activity relying on legitimate interest is required to complete an LIA using this template for each such processing activity.
The Records of Processing Activities ("ROPA") maintained by the NTP Group currently identify one hundred and forty-seven (147) catalogued processing activities across all group entities. Of these, sixty-four (64) processing activities rely on legitimate interest as their lawful basis under Article 6(1)(f), representing approximately 43.5% of all catalogued processing activities. Each of these sixty-four processing activities requires a completed LIA, and no processing activity should proceed or continue on the basis of legitimate interest without a corresponding LIA that has been reviewed and approved in accordance with the governance procedures set out in this template.
This template has been developed in alignment with the following authoritative guidance:
(a) the Information Commissioner's Office ("ICO") guidance on legitimate interests, as published and updated on the ICO website;
(b) the European Data Protection Board ("EDPB") guidance on Article 6(1)(f) of the GDPR, including the former Article 29 Working Party Opinion 06/2014 on the notion of legitimate interests of the data controller (WP217); and
(c) the three-part test framework endorsed by supervisory authorities across the United Kingdom and the European Union, comprising the Purpose Test, the Necessity Test, and the Balancing Test.
The adoption of a standardised template ensures consistency of approach across the NTP Group, facilitates oversight by the Data Protection Officer, and provides a readily auditable record in the event of a regulatory inquiry, complaint, or enforcement action.
1.2 Legal Basis
Article 6(1)(f) of both the UK GDPR and the EU GDPR provides that processing of personal data shall be lawful where:
"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."
Legitimate interest is one of six lawful bases for processing personal data under the GDPR. Unlike consent, it does not require a specific affirmative act by the data subject; unlike contractual necessity, it does not depend on the existence of a contractual relationship between the controller and the data subject. However, legitimate interest is not a default or fallback basis — it requires a careful and documented assessment to demonstrate that the controller's (or a third party's) interest is not overridden by the data subject's interests, rights, or fundamental freedoms.
It is important to note the following limitations on the use of legitimate interest as a lawful basis:
(a) Public authorities. Article 6(1), second sub-paragraph, provides that legitimate interest under point (f) shall not apply to processing carried out by public authorities in the performance of their tasks. This restriction is not applicable to NTP, as NTP is a private-sector telecommunications operator and is not a public authority for the purposes of the GDPR. However, where NTP processes personal data at the direction of a public authority (for example, in response to lawful intercept warrants issued under the Investigatory Powers Act 2016), such processing is conducted under a separate lawful basis (typically legal obligation under Article 6(1)(c)) and is not within the scope of this template.
(b) Special category data. Processing of special categories of personal data as defined in Article 9(1) of the GDPR (including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation) cannot rely on legitimate interest alone. A separate condition under Article 9(2) must be identified and satisfied in addition to the Article 6 lawful basis. If a processing activity involves special category data, the business unit data steward completing the LIA must escalate the matter to the DPO for further analysis.
(c) Criminal offence data. Processing of personal data relating to criminal convictions and offences, or related security measures, as referred to in Article 10 of the GDPR, is subject to additional conditions and cannot be carried out solely on the basis of legitimate interest without satisfying the applicable requirements under Article 10 and relevant domestic law (e.g., Schedule 1 of the UK Data Protection Act 2018). Again, any processing activity involving criminal offence data must be escalated to the DPO for separate assessment.
1.3 Scope of Application
This template is applicable to all NTP Group entities acting as data controllers in respect of processing activities that rely on legitimate interest as their lawful basis. It covers the processing of personal data relating to all categories of data subjects whose personal data is processed by the NTP Group, including but not limited to:
•  Consumer subscribers: approximately 6.3 million individuals across the NTP Group's UK and European markets who hold consumer mobile, broadband, or fixed-line telecommunications subscriptions with NTP;
•  Enterprise clients: approximately 42,000 business-to-business clients and their associated business contacts, including procurement officers, IT administrators, account managers, and other representatives of corporate and public-sector customers;
•  Employees: approximately 11,400 individuals employed directly by NTP Group entities across the United Kingdom, the Republic of Ireland, Germany, the Netherlands, France, and Spain;
•  Contractors, temporary workers, and job applicants: approximately 28,000 individuals, including agency workers, consultants, freelancers, candidates who have applied for employment with NTP Group entities, and individuals whose personal data is collected through NTP's recruitment processes; and
•  Website visitors: individuals who visit NTP's corporate and consumer-facing websites and whose personal data (including IP addresses, device identifiers, and browsing behaviour) may be collected through cookies or similar tracking technologies, to the extent that such processing relies on legitimate interest rather than consent.
This template is to be used in conjunction with, and not as a substitute for, the following NTP Group policies, procedures, and records:
(a) the NTP Group Records of Processing Activities ("ROPA"), maintained in accordance with Article 30 of the GDPR;
(b) the NTP Group Data Protection Policy, which sets out the overarching principles and governance framework for data protection compliance across the NTP Group;
(c) relevant Data Protection Impact Assessments ("DPIAs"), where a processing activity that relies on legitimate interest has also been identified as likely to result in a high risk to the rights and freedoms of natural persons under Article 35 of the GDPR; and
(d) relevant Transfer Impact Assessments ("TIAs"), where a processing activity involves transfers of personal data to a third country or international organisation.
1.4 Governance and Responsibilities
The following individuals and functions have defined roles and responsibilities in connection with the completion, review, approval, and maintenance of LIAs within the NTP Group:
Data Protection Officer — Sanjay Mehta. The DPO has overall oversight responsibility for LIA completion, quality review, and ongoing maintenance across the NTP Group. The DPO is responsible for ensuring that all LIAs are documented, reviewed, and stored in the NTP Sundial Solutions privacy management platform, as configured and maintained by Ashdown Consulting Group Ltd. The DPO reviews each completed LIA for quality, completeness, and legal sufficiency, and may require amendments or additional analysis before providing a review endorsement. The DPO also monitors the LIA review schedule and ensures that LIAs are refreshed in accordance with the review triggers identified in this template. In cases involving novel, complex, or high-risk processing activities, the DPO may escalate the LIA for additional review by the General Counsel (Fiona Gallagher) or seek external advisory support from Calderwood & Harkness LLP.
Business Unit Data Stewards. Each business unit within the NTP Group has a designated data steward who is responsible for identifying processing activities within their business unit that rely on legitimate interest, and for drafting the LIA for each such processing activity using this template. Business unit data stewards are expected to have sufficient knowledge of the processing activity to provide detailed, accurate, and specific responses to each section of the template. The data steward must consult with the DPO during the drafting process and must not finalise or approve an LIA without the DPO's review. Data stewards are also responsible for monitoring their processing activities on an ongoing basis and for initiating a review of the relevant LIA in the event of a material change to the processing.
Chief Information Security Officer — Thomas Okoye. The CISO provides input on the technical and organisational security measures that are relevant to the balancing test in Part B of the LIA. The CISO's function is responsible for assessing and confirming the adequacy of safeguards such as pseudonymisation, encryption, access controls, audit logging, retention enforcement, and intrusion detection, as they relate to the processing activity under assessment. The CISO or a member of the CISO's team should be consulted during the completion of Section 4.3.5 (Safeguards) of any LIA involving significant volumes of personal data, sensitive data categories, or complex technical processing.
Calderwood & Harkness LLP. Calderwood & Harkness LLP is available to provide advisory support on complex or novel LIAs during the engagement period under the terms of the matter referenced SC/NTP/2023-0213/PDS. This includes advisory support on the interpretation of Article 6(1)(f), the application of the three-part test to novel processing scenarios, and the assessment of regulatory risk. Business unit data stewards or the DPO may request advisory support through the established instruction protocol.
Review and Refresh Requirements. LIAs must be reviewed and refreshed at least annually, or sooner if triggered by a material change in the processing activity. Material changes that trigger an earlier review include, but are not limited to:
•  the introduction of new categories of personal data into the processing activity;
•  the expansion of the processing to new categories of data subjects;
•  the addition of new recipients or processors;
•  the introduction of new international transfers or changes to the transfer mechanism;
•  changes in the regulatory or legal landscape, including new guidance from the ICO, EDPB, or relevant EU supervisory authorities;
•  the receipt of complaints, data subject objections, or regulatory inquiries concerning the processing activity; and
•  changes in the scope, scale, or manner of processing that could affect the outcome of the balancing test.
SECTION 2: INSTRUCTIONS FOR COMPLETION
2.1 When to Complete an LIA
An LIA must be completed in each of the following circumstances:
(a) Before commencing any new processing activity where legitimate interest is identified as the proposed lawful basis. The LIA must be completed and reviewed by the DPO before the processing activity commences. No processing activity may proceed on the basis of legitimate interest without a completed and reviewed LIA.
(b) When an existing processing activity relying on legitimate interest is materially changed. A material change includes, but is not limited to, a change in the scope of the processing (e.g., processing additional categories of personal data or processing data of additional categories of data subjects), a change in the recipients of the data, the introduction of new international data transfers, or a change in the technical or organisational measures applied to the processing. Where a material change occurs, the existing LIA must be reviewed and, where necessary, updated or replaced with a new LIA reflecting the changed circumstances.
(c) As part of the annual ROPA review cycle. The NTP Group conducts an annual review of its ROPA, during which all processing activities and their associated lawful bases are reviewed for accuracy and completeness. As part of this annual review, each LIA must be reviewed to confirm that it remains current and that the balancing test conclusion remains valid in light of any changes in circumstance, regulatory guidance, or industry practice.
(d) Where a DPIA is triggered for a processing activity that also relies on legitimate interest. Where a processing activity is identified as likely to result in a high risk to the rights and freedoms of natural persons and therefore requires a DPIA under Article 35 of the GDPR, and that processing activity also relies on legitimate interest as its lawful basis, the LIA should be completed first and annexed to the DPIA. The LIA informs the lawful basis analysis within the DPIA and should be cross-referenced in the DPIA documentation.
2.2 How to Complete the Template
The template is structured in four parts (Parts A through D), which must be completed sequentially:
Part A: Administrative and Contextual Information. This section captures the identification details for the assessment, the controller entity, the processing activity, the categories of data subjects and personal data involved, and the recipients and transfers associated with the processing. This information should be drawn from the corresponding ROPA entry and verified for accuracy.
Part B: Three-Part Legitimate Interest Test. This is the substantive section of the LIA, comprising the three elements of the legitimate interest test:
•  Part 1 — Purpose Test: Identifies the specific legitimate interest being pursued, confirms that the interest is real, current, lawful, and sufficiently clearly articulated, and identifies whose interest it is.
•  Part 2 — Necessity Test: Assesses whether the processing is genuinely necessary for the stated purpose and whether the purpose could reasonably be achieved by less intrusive means.
•  Part 3 — Balancing Test: Weighs the controller's legitimate interest against the interests, rights, and fundamental freedoms of the data subjects, taking into account the nature of the data, the data subjects' reasonable expectations, the likely impact on data subjects, any power imbalance, and the safeguards in place.
Part C: Outcome and Decision. This section records the conclusion of the assessment — whether legitimate interest is a valid lawful basis, whether additional safeguards are required, or whether legitimate interest is not a valid lawful basis and an alternative must be identified. It also addresses the right to object under Article 21.
Part D: Approval and Review. This section records the details of the individual who prepared the LIA, the DPO's review, any escalated approvals, and the review schedule.
When completing the template, the following principles should be observed:
•  Use clear, specific language. Responses should be detailed, factual, and specific to the processing activity under assessment. Avoid generic, boilerplate, or vague language. Each LIA should be a bespoke document that reflects the particular circumstances of the processing activity to which it relates.
•  Cross-reference the ROPA. Each LIA must include the corresponding ROPA entry number. Where the processing involves international transfers, the applicable Transfer Impact Assessment (TIA) reference number should also be included. Where the processing is also subject to a DPIA, the DPIA reference number should be cross-referenced.
•  Be candid about risks. The balancing test requires an honest and balanced assessment of the potential impact on data subjects. Understating risks or omitting potential negative impacts will undermine the integrity of the LIA and may expose the NTP Group to regulatory risk.
•  Document alternatives considered. The necessity test requires the assessor to demonstrate that less intrusive alternatives have been genuinely considered and to explain why they were adopted or rejected. A conclusory statement that "there are no alternatives" will not satisfy this requirement.
2.3 Record-Keeping
Completed LIAs form part of the NTP Group's accountability records under Article 5(2) and Article 24 of the GDPR. The following record-keeping requirements apply:
(a) All completed LIAs must be uploaded to the NTP Sundial Solutions privacy management platform. The Sundial Solutions platform has been configured by Ashdown Consulting Group Ltd to accommodate the LIA template structure and to link each LIA to the corresponding ROPA entry, DPIA (if applicable), and TIA (if applicable).
(b) A copy of each completed LIA must be retained by the DPO as part of the NTP Group's central accountability file. The DPO is responsible for maintaining an index of all completed LIAs and for monitoring the review schedule.
(c) LIAs may be requested by the ICO (in respect of processing activities undertaken by NTP PLC or other NTP entities subject to ICO jurisdiction) or by the relevant EU supervisory authority (for example, the Data Protection Commission of Ireland in respect of processing activities undertaken by Northgate Ireland Ltd) as part of any regulatory inquiry, investigation, audit, or enforcement action. LIAs must therefore be maintained in a form that is readily accessible and can be provided to a supervisory authority within a reasonable timeframe upon request.
(d) LIAs must be retained for the duration of the processing activity to which they relate, and for a period of at least six (6) years following the cessation of the processing activity, in accordance with the NTP Group's document retention policy and to account for potential regulatory or litigation time limits.
SECTION 3: TEMPLATE — PART A: ADMINISTRATIVE INFORMATION
Instructions: Complete all fields below. Where a field is not applicable, enter "N/A" with a brief explanation. This section should be completed by the business unit data steward responsible for the processing activity, in consultation with the DPO.
3.1 Assessment Identification
LIA Reference Number:
[Insert — use the following format: LIA-[Entity Code]-[YYYY]-[Sequential Number]]
Entity Codes: NTP (Northgate Telecommunications PLC); NIL (Northgate Ireland Ltd); NGmbH (Northgate GmbH); NBV (Northgate B.V.); NFSAS (Northgate France SAS); NIS (Northgate Iberia S.L.)
Example: LIA-NTP-2023-001
ROPA Entry Reference:
[Insert the corresponding ROPA entry number as recorded in the NTP Group Records of Processing Activities maintained on the Sundial Solutions platform]
Related DPIA (if applicable):
[Insert the DPIA reference number if this processing activity has been identified as high-risk and is subject to a Data Protection Impact Assessment. The NTP Group currently maintains DPIAs numbered DPIA-001 through DPIA-011. If no DPIA is applicable, enter "N/A".]
Related TIA (if applicable):
[Insert the Transfer Impact Assessment reference number if this processing activity involves international transfers of personal data to a third country or international organisation. The NTP Group currently maintains TIAs numbered TIA-001 through TIA-006. If no TIA is applicable, enter "N/A".]
3.2 Controller Details
Controller Entity:
[Insert the full legal name of the NTP Group entity acting as data controller in respect of this processing activity. Select from: Northgate Telecommunications PLC / Northgate Ireland Ltd / Northgate GmbH / Northgate B.V. / Northgate France SAS / Northgate Iberia S.L.]
Registered Office:
[Insert the registered office address of the controller entity]
Company / Registration Number:
[Insert the company or commercial registration number of the controller entity in the relevant jurisdiction]
Lead Supervisory Authority:
[Insert the lead supervisory authority for the controller entity — e.g., ICO (Information Commissioner's Office, United Kingdom) for NTP PLC; DPC (Data Protection Commission, Ireland) for Northgate Ireland Ltd; BfDI (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, Germany) for Northgate GmbH; AP (Autoriteit Persoonsgegevens, the Netherlands) for Northgate B.V.; CNIL (Commission nationale de l'informatique et des libertés, France) for Northgate France SAS; AEPD (Agencia Española de Protección de Datos, Spain) for Northgate Iberia S.L.]
3.3 Processing Activity Description
Name of Processing Activity:
[Insert a concise, descriptive name for the processing activity — e.g., "Network Performance Optimisation," "Customer Churn Propensity Analysis," "Employee IT Systems Monitoring"]
Business Unit / Department:
[Insert the name of the business unit or department within the controller entity that is responsible for this processing activity — e.g., "Network Operations," "Marketing," "Human Resources," "Information Security"]
Business Unit Data Steward:
[Insert the name and title of the designated data steward for the relevant business unit]
Description of Processing:
[Provide a clear and detailed description of the processing activity. This description should address the following questions at a minimum:
•  What personal data is collected?
•  From whom is the personal data collected (directly from the data subject, from a third party, generated by NTP systems)?
•  How is the personal data processed (collection, recording, storage, structuring, retrieval, consultation, use, disclosure, erasure, etc.)?
•  What is the purpose of the processing?
•  How are the outputs of the processing used?
•  What is the retention period for the personal data?
•  What technical and organisational measures are applied to the processing?
The description should be sufficiently detailed to enable the DPO to understand the full scope of the processing without needing to seek additional information. Cross-reference the corresponding ROPA entry as appropriate.]
3.4 Data Subject Categories
[Tick or list all categories of data subjects whose personal data is processed in connection with this processing activity:]
•  [ ] Consumer subscribers
•  [ ] Enterprise clients / business contacts
•  [ ] Employees
•  [ ] Contractors / temporary workers
•  [ ] Job applicants
•  [ ] Website visitors
•  [ ] Other (specify): [Insert description of any additional data subject categories]
[Where the processing involves data subjects who are children (under the age of 18, or under the applicable age threshold in the relevant jurisdiction), this must be expressly noted here. The involvement of children's data is a significant factor in the balancing test and may weigh heavily against the use of legitimate interest as a lawful basis.]
3.5 Categories of Personal Data Processed
[List all categories of personal data involved in this processing activity. Be specific and comprehensive. Examples include, but are not limited to:]
•  Name, title, and contact details (postal address, email address, telephone number)
•  Account and subscription information
•  IP addresses and device identifiers
•  Location data (precise GPS, approximate cell-tower level, or inferred)
•  Subscriber metadata (call detail records, data session records)
•  Network usage data (data throughput, session duration, cell tower handover data)
•  Device type and configuration information
•  Financial and payment information
•  Employment information (job title, department, salary, performance data)
•  Browsing behaviour and cookie data
•  Communications content (if applicable — note heightened sensitivity)
•  Other (specify): [Insert]
Special category data involved?
[Yes / No]
If Yes, identify the specific category of special category data involved and note that legitimate interest under Article 6(1)(f) alone is insufficient as a lawful basis for processing special category data. An additional condition under Article 9(2) of the GDPR must be identified and documented. The processing should be escalated to the DPO for further analysis before proceeding.
3.6 Recipients and Transfers
Internal recipients:
[List all NTP Group entities, departments, teams, or functions that receive or have access to the personal data in connection with this processing activity. Include any shared services functions or centralised teams that may access the data.]
External recipients / processors:
[List all third-party recipients of the personal data, including data processors engaged by the controller under Article 28 of the GDPR. For each external recipient, indicate whether they are acting as a controller, joint controller, or processor, and reference the applicable data processing agreement or data sharing agreement.]
International transfers:
[Yes / No]
If Yes, specify:
•  The destination country or countries to which personal data is transferred;
•  The transfer mechanism relied upon (e.g., adequacy decision under Article 45; EU Standard Contractual Clauses under Article 46(2)(c); UK International Data Transfer Agreement ("UK IDTA"); UK Addendum to the EU SCCs; binding corporate rules under Article 47; derogation under Article 49);
•  The corresponding Transfer Impact Assessment (TIA) reference number.
If No, confirm that all processing is conducted within the United Kingdom and/or the European Economic Area.
SECTION 4: TEMPLATE — PART B: THREE-PART LEGITIMATE INTEREST TEST
Instructions: This is the substantive section of the LIA. Complete all three parts of the test sequentially. Provide detailed, specific, and evidence-based responses. The quality and rigour of this section is critical to the defensibility of the LIA in the event of a regulatory inquiry.
4.1 Part 1 — Purpose Test: Identifying the Legitimate Interest
The purpose test requires the controller to identify the specific legitimate interest that it (or a third party) is pursuing through the processing, and to confirm that the interest is real, current, lawful, and sufficiently clearly articulated.
4.1.1 What is the legitimate interest being pursued?
[Describe the specific interest or interests of the controller or third party that the processing is intended to serve. The interest must be real and present — not speculative, hypothetical, or contingent on future events. The interest may be a commercial interest of the controller, a wider societal benefit, or the interests of the data subjects themselves.]
[Where multiple interests are pursued, each should be separately identified and described.]
Guidance for assessors: Legitimate interests recognised by supervisory authorities and the courts as capable of supporting processing under Article 6(1)(f) include, but are not limited to:
•  Network security, cybersecurity, and fraud prevention (see Recital 47 and Recital 49 of the GDPR);
•  Direct marketing to existing customers, including the "soft opt-in" under Regulation 22 of the Privacy and Electronic Communications Regulations 2003 (UK) or equivalent national implementations of the ePrivacy Directive;
•  Intra-group data transfers for internal administrative purposes, including client and employee administration (see Recital 48 of the GDPR);
•  Network optimisation and service quality improvement;
•  Physical security of premises and assets, including CCTV surveillance;
•  IT system monitoring and maintenance;
•  Business intelligence and analytics, including operational reporting and performance management;
•  Prevention and detection of crime, including whistleblowing schemes;
•  Legal claims — the establishment, exercise, or defence of legal claims;
•  Research and development, where conducted for the controller's own purposes; and
•  Compliance with voluntary codes of conduct or industry standards.
4.1.2 Whose legitimate interest is it?
[Identify whose interest is being pursued. Select one:]
•  [ ] The controller's own interest
•  [ ] A third party's interest (specify the third party and the nature of their interest): [Insert]
•  [ ] Both the controller's interest and a third party's interest (specify): [Insert]
[Where the interest is that of a third party, the controller must be able to articulate the third party's interest with sufficient specificity and must be satisfied that the third party's interest is itself legitimate.]
4.1.3 Is the interest lawful?
[Confirm that the processing does not involve any unlawful activity and does not conflict with any applicable law, regulation, industry code of practice, or regulatory obligation. The interest must be consistent with the legal and regulatory framework applicable to the controller's operations.]
[If the processing involves any activity that could potentially be unlawful or is subject to legal uncertainty, this must be disclosed here and escalated to the DPO and, where appropriate, to the General Counsel.]
Assessment: [Yes / No]
If No, legitimate interest cannot be relied upon as a lawful basis for this processing activity. The assessment should be terminated and an alternative lawful basis must be considered.
4.1.4 Is the interest sufficiently clearly articulated?
[The interest must not be vague, generic, or overly broad. A statement that the processing is "in the controller's commercial interests" or "for business purposes" is insufficient. State the specific business objective or purpose that the processing is intended to achieve.]
[If the interest is not sufficiently clearly articulated, revisit Section 4.1.1 and refine the description of the interest before proceeding to the Necessity Test.]
Assessment: [Yes / No — provide supporting explanation]
4.2 Part 2 — Necessity Test
The necessity test requires the controller to demonstrate that the processing is genuinely necessary for the purpose of pursuing the legitimate interest identified in Part 1, and that the purpose cannot reasonably be achieved by less intrusive means. "Necessary" in this context does not mean "absolutely essential" or "indispensable," but it does require more than mere convenience or desirability. The processing must be a proportionate and reasonably targeted means of achieving the stated purpose.
4.2.1 Is the processing necessary for the stated purpose?
[Explain why the processing is necessary to achieve the legitimate interest identified in Part 1. Demonstrate that the purpose cannot reasonably be achieved without processing personal data in the manner described.]
[In conducting this analysis, consider the following questions:]
•  Could the same objective be achieved without processing personal data at all?
•  Could the same objective be achieved by processing less personal data (i.e., fewer data fields or categories)?
•  Could the same objective be achieved by processing data less intrusively — for example, through aggregation, anonymisation, or pseudonymisation?
•  Could the same objective be achieved by processing the personal data of fewer data subjects?
•  Could the same objective be achieved by using personal data that is less sensitive or less granular?
[Provide a substantive explanation. A conclusory statement that "the processing is necessary" without supporting reasoning will not satisfy this test.]
4.2.2 Are there less intrusive alternatives?
[Describe the alternative approaches that were considered and explain why they were rejected or adopted. This is a critical part of the necessity analysis and demonstrates that the controller has genuinely engaged with the principle of data minimisation.]
[Where alternative approaches were partially adopted — for example, where pseudonymisation was applied to reduce the intrusiveness of the processing — describe the measures adopted and explain why they are sufficient (or insufficient on their own) to achieve the stated purpose.]
[If pseudonymisation, data minimisation, or other mitigating measures have been incorporated into the processing design, describe them in detail here. These measures will also be relevant to the balancing test in Part 3.]
4.2.3 Is the processing proportionate to the aim pursued?
[Assess whether the scope, scale, and manner of processing is proportionate to the legitimate interest identified. Proportionality requires a reasonable relationship between the means (the processing) and the end (the legitimate interest). Consider whether the extent of the processing is commensurate with the significance of the interest pursued, and whether the processing is limited to what is reasonably required.]
Assessment: [Provide a clear statement as to whether the processing is proportionate, with supporting reasoning.]
4.3 Part 3 — Balancing Test
The balancing test is the core of the LIA. It requires the controller to weigh its legitimate interest (as identified and justified in Parts 1 and 2) against the interests, rights, and fundamental freedoms of the data subjects affected by the processing. The outcome of the balancing test determines whether legitimate interest is a valid lawful basis. This assessment must be conducted objectively and with due regard to the perspective of the data subjects.
4.3.1 What is the nature of the personal data?
[Consider the sensitivity and nature of the personal data being processed. The nature of the data is a significant factor in the balancing test. The following considerations apply:]
•  Routine business contact details (e.g., name, work email, job title) are generally lower risk.
•  Location data, financial data, communications metadata, and browsing behaviour are higher risk.
•  Special category data (Article 9) is the highest risk category. If special category data is involved, legitimate interest alone is insufficient — see Section 1.2 above.
•  Data concerning children carries particularly heightened sensitivity and weight in the balancing test. Article 6(1)(f) expressly singles out data subjects who are children, and the ICO and EDPB have consistently emphasised the need for additional protections.
[Describe the nature of the personal data involved in this processing activity and assess its sensitivity.]
4.3.2 What are the reasonable expectations of the data subjects?
[The reasonable expectations of the data subjects are a key factor in the balancing test. Processing that is within the data subjects' reasonable expectations is more likely to be justified; processing that would surprise or concern data subjects weighs against the controller.]
[Consider the following questions:]
•  Would the data subjects reasonably expect this type of processing to take place?
•  Has the processing been disclosed to data subjects in a privacy notice (and if so, in what terms)?
•  Is there an existing relationship between the controller and the data subject (e.g., customer-service provider, employer-employee)?
•  In what context was the personal data originally collected? Would data subjects expect the data to be used in this way?
•  Has the purpose of the processing changed since the data was originally collected?
•  Is the processing visible or transparent to the data subjects, or is it carried out behind the scenes?
[Provide a detailed assessment of data subjects' reasonable expectations in relation to this processing activity.]
4.3.3 What is the likely impact on data subjects?
Positive impacts:
[Describe any benefits that the processing provides to the data subjects. These may include improved service quality, enhanced security, personalised content or offers, more efficient administration, or other tangible or intangible benefits. Positive impacts should be specific and realistic — not aspirational or speculative.]
Negative impacts / risks:
[Describe the potential adverse effects of the processing on data subjects. These may include, but are not limited to:]
•  Intrusiveness or invasion of privacy
•  Loss of control over personal data
•  Unwanted contact or communications
•  Chilling effects on freedom of expression or freedom of association
•  Risk of discrimination or bias
•  Financial loss or economic disadvantage
•  Reputational harm
•  Physical harm or safety risks
•  Emotional distress or psychological impact
•  Risk of data breach and consequential harm
[Be candid and thorough. The credibility and defensibility of the LIA depends on an honest assessment of risks.]
Severity and likelihood of impact:
[Assess the severity and likelihood of the potential negative impacts identified above, using the following scale:]
[Provide a combined assessment of severity and likelihood, with supporting reasoning.]
4.3.4 Is the controller in a position of power over the data subjects?
[Consider whether there is a significant power imbalance between the controller and the data subjects. Power imbalances may arise in a number of contexts relevant to the NTP Group, including:]
•  Employer-employee relationships: NTP Group entities employ approximately 11,400 individuals. In an employment context, the employee may feel unable to refuse or object to processing, given the inherent power imbalance in the employment relationship. This is a significant factor that weighs against the controller's interest.
•  Essential service provider relationships: As a telecommunications provider, NTP provides services that may be regarded as essential to the daily lives of its approximately 6.3 million consumer subscribers. While subscribers have a degree of choice and switching is facilitated by Ofcom's number portability requirements, the practical barriers to switching may limit the data subject's ability to exercise meaningful control.
•  Contractor and temporary worker relationships: Similar considerations may apply to contractors and temporary workers whose ongoing engagement depends on NTP.
[Assess whether a power imbalance exists and, if so, the extent to which it affects the balancing test.]
4.3.5 What safeguards can be put in place to mitigate impact?
[List all technical and organisational measures that are in place, or that will be implemented, to reduce the impact of the processing on data subjects and to protect their interests, rights, and freedoms. The effectiveness of safeguards is a critical factor in the balancing test and may be decisive in borderline cases.]
[Safeguards may include, but are not limited to:]
•  Data minimisation: Limiting the personal data processed to what is strictly necessary for the stated purpose.
•  Pseudonymisation: Replacing directly identifying data with pseudonymous identifiers, with the re-identification key held separately under appropriate access controls.
•  Encryption: Encrypting personal data at rest and in transit.
•  Access controls and role-based permissions: Restricting access to personal data to authorised personnel on a need-to-know basis.
•  Retention limits: Implementing automated or procedural retention limits to ensure that personal data is not retained for longer than necessary.
•  Opt-out mechanisms: Providing data subjects with a clear and accessible mechanism to object to the processing under Article 21 of the GDPR.
•  Transparency measures: Ensuring that the processing is clearly described in the controller's privacy notice(s), including layered disclosures where appropriate.
•  Human review of automated outputs: Where the processing involves automated decision-making or profiling, ensuring that a human review mechanism is available before any decisions with significant effects are implemented.
•  Regular audits: Conducting periodic audits of the processing activity, the data held, and the effectiveness of the safeguards, under the oversight of the CISO function or internal audit.
•  Staff training: Ensuring that personnel involved in the processing activity have received appropriate data protection training.
•  Incident response: Ensuring that the processing activity is covered by NTP's data breach detection and response procedures.
[For each safeguard identified, briefly describe how it is implemented and who is responsible for its maintenance.]
4.3.6 Overall Balancing Assessment
[Drawing on all of the factors assessed in Sections 4.3.1 through 4.3.5, provide an overall assessment of the balance between the controller's legitimate interest and the data subjects' interests, rights, and freedoms.]
[This assessment should weigh:]
•  The importance and specificity of the legitimate interest (from Part 1);
•  The necessity of the processing and the absence of less intrusive alternatives (from Part 2);
•  The nature and sensitivity of the personal data (4.3.1);
•  The data subjects' reasonable expectations (4.3.2);
•  The positive and negative impacts on data subjects, including severity and likelihood (4.3.3);
•  Any power imbalance (4.3.4); and
•  The safeguards in place or to be implemented (4.3.5).
Conclusion:
[State the conclusion of the balancing test clearly:]
•  The controller's legitimate interest is not overridden by the interests, rights, or freedoms of the data subjects. Legitimate interest is a valid lawful basis for this processing activity.
OR
•  The controller's legitimate interest is overridden by the interests, rights, or freedoms of the data subjects. Legitimate interest is not a valid lawful basis for this processing activity.
[Provide clear and specific reasoning supporting the conclusion. The reasoning should demonstrate that the assessment has been conducted in a balanced and objective manner, with genuine consideration of the data subjects' perspective.]
SECTION 5: TEMPLATE — PART C: OUTCOME AND DECISION
Instructions: Complete this section based on the conclusion of the three-part test in Part B. Select the applicable outcome and complete the remaining fields as indicated.
5.1 Outcome
[Select one of the following outcomes:]
•  [ ] Legitimate interest is a valid lawful basis. The controller's legitimate interest is not overridden by the data subjects' interests, rights, or freedoms. Processing may proceed on this basis, subject to the safeguards identified in Section 4.3.5 and any additional safeguards specified in Section 5.2.
•  [ ] Legitimate interest is a valid lawful basis, subject to additional safeguards. The controller's legitimate interest is not overridden by the data subjects' interests, rights, or freedoms, provided that the additional safeguards specified in Section 5.2 below are implemented before or during the processing. Processing may not proceed until all additional safeguards have been confirmed as operational.
•  [ ] Legitimate interest is NOT a valid lawful basis. The data subjects' interests, rights, or freedoms override the controller's legitimate interest. An alternative lawful basis must be identified under Article 6(1) of the GDPR, or the processing must not proceed. The assessor should proceed to Section 5.3 to consider alternative lawful bases.
5.2 Safeguards Required (if applicable)
[If the outcome selected is the first or second option above, list all specific safeguards that must be in place before or during the processing activity. For each safeguard, assign responsibility for implementation and set an implementation deadline.]
[The DPO should verify that all required safeguards have been implemented before endorsing the LIA. The CISO should confirm the implementation of any technical safeguards.]
5.3 Alternative Lawful Basis Considered (if LI rejected)
[If the outcome of the LIA is that legitimate interest is not a valid lawful basis for the processing activity, the assessor should consider whether an alternative lawful basis under Article 6(1) of the GDPR may be available. Alternative lawful bases include:]
(a) Consent (Article 6(1)(a)) — the data subject has given consent to the processing for one or more specific purposes;
(b) Contract performance (Article 6(1)(b)) — the processing is necessary for the performance of a contract to which the data subject is party, or for taking steps at the request of the data subject prior to entering into a contract;
(c) Legal obligation (Article 6(1)(c)) — the processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) Vital interests (Article 6(1)(d)) — the processing is necessary to protect the vital interests of the data subject or of another natural person;
(e) Public interest (Article 6(1)(e)) — the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
[Identify any alternative lawful basis that may be applicable and state whether a separate assessment is required before the processing can proceed on that alternative basis.]
5.4 Right to Object
Confirmation: Data subjects must be informed of their right to object to processing carried out on the basis of legitimate interest, in accordance with Article 21 of the GDPR.
[Confirm that the following requirements will be met:]
(a) The privacy notice(s) applicable to this processing activity clearly inform data subjects of their right to object to the processing under Article 21 of the GDPR, including the right to object on grounds relating to their particular situation;
(b) The mechanism through which data subjects may exercise their right to object is clearly described and easily accessible. For NTP Group entities, objections may be submitted through the following channels:
•  The online data subject rights request form on the NTP website;
•  By email to the DPO at the designated privacy email address;
•  By post to the DPO at the registered office of the relevant NTP Group entity;
•  By telephone to the NTP customer services team (for consumer subscribers).
(c) All objections received will be handled in accordance with NTP's Data Subject Rights Procedure, which requires an individual assessment of each objection to determine whether the controller's compelling legitimate grounds override the data subject's grounds for objection, in accordance with Article 21(1) of the GDPR;
(d) Where the processing relates to direct marketing, the data subject has an absolute right to object under Article 21(2), and the processing must cease upon receipt of the objection, without any further assessment.
SECTION 6: TEMPLATE — PART D: APPROVAL AND REVIEW
Instructions: Complete this section upon finalisation of the LIA. The assessment must be prepared by the business unit data steward, reviewed by the DPO, and (where applicable) escalated for additional approval.
6.1 Prepared By
Name: [Insert the full name of the individual who prepared the LIA]
Title / Role: [Insert the title or role of the individual — e.g., "Data Steward, Network Operations"]
Business Unit: [Insert the business unit or department]
Date: [Insert the date of completion]
Signature: ________
Name:
Title:
Date:
6.2 Reviewed By (Data Protection Officer)
Name: [Insert — e.g., Sanjay Mehta, Data Protection Officer, Northgate Telecommunications PLC]
Date of Review: [Insert the date on which the DPO completed the review]
Comments: [Insert any observations, conditions, recommended amendments, or additional requirements noted by the DPO during the review. If the DPO endorses the LIA without conditions, state "Reviewed and endorsed without conditions."]
Signature: ________
Name:
Title: Data Protection Officer
Date:
6.3 Approved By (if escalation required)
[For complex, novel, or high-risk LIAs, the DPO may escalate the assessment for additional approval by the General Counsel (Fiona Gallagher, General Counsel, Northgate Telecommunications PLC) or the Chief Information Security Officer (Thomas Okoye, CISO, Northgate Telecommunications PLC). Escalation is recommended where:]
•  The processing involves large-scale processing of location data, communications metadata, or other data with heightened sensitivity;
•  The balancing test is finely balanced or the outcome is not clear-cut;
•  The processing involves a novel technology or a new application of an existing technology;
•  The processing has been the subject of a data subject complaint or a regulatory inquiry;
•  The processing involves a significant power imbalance between the controller and data subjects; or
•  The DPO considers that escalation is otherwise appropriate.
Name: [Insert the name and title of the approver, if applicable, or "N/A — escalation not required"]
Date: [Insert the date of approval, if applicable]
Signature: ________
Name:
Title:
Date:
6.4 Review Schedule
Next Review Date:
[Insert the date of the next scheduled review. This date must be no later than twelve (12) months from the date of approval. The review date should be earlier than twelve months where the processing activity is novel, high-risk, or subject to known upcoming regulatory changes.]
Review Triggers:
[In addition to the scheduled annual review, the following circumstances require an immediate or expedited review of this LIA:]
•  Changes in regulatory or supervisory authority guidance on legitimate interest (including new ICO, EDPB, or national authority guidance);
•  Introduction of new categories of personal data into the processing activity;
•  Expansion of the processing to new categories of data subjects;
•  Addition of new recipients or changes to the processors engaged;
•  Introduction of new international data transfers or changes to the transfer mechanism;
•  Receipt of complaints or objections from data subjects in relation to the processing activity;
•  Receipt of a regulatory inquiry, audit request, or enforcement notice in relation to the processing activity;
•  Changes in the scope, scale, or manner of processing that could affect the outcome of the balancing test;
•  Identification of a data breach involving the personal data processed under this LIA;
•  Organisational changes (e.g., mergers, acquisitions, restructuring) affecting the controller entity; and
•  Any other change in circumstances that the DPO considers material.
Review History:
SECTION 7: WORKED EXAMPLE — NETWORK OPTIMISATION PROCESSING
This worked example is provided for illustrative purposes to demonstrate how to complete the LIA template. It is based on NTP's network optimisation processing activity and is intended to assist business unit data stewards in understanding the level of detail and specificity expected in a completed LIA. This worked example should not be treated as a substitute for an independent assessment of each processing activity.
7.1 Part A — Administrative Information (Worked Example)
LIA Reference Number: LIA-NTP-2023-EX1
ROPA Entry Reference: ROPA-NTP-037
Related DPIA: N/A — Network performance optimisation processing was assessed against the Article 35 high-risk criteria and was not identified as requiring a DPIA. The processing does not involve systematic and extensive profiling with significant effects, large-scale processing of special category data, or systematic monitoring of a publicly accessible area.
Related TIA: N/A — All processing is conducted within the United Kingdom. No international transfer of personal data occurs in connection with this processing activity.
Controller Entity: Northgate Telecommunications PLC
Registered Office: 140 Queensway Place, Reading, Berkshire RG1 4QT, United Kingdom
Company Number: 04837291
Lead Supervisory Authority: Information Commissioner's Office (ICO), United Kingdom
ICO Registration Number: ZA482917
Name of Processing Activity: Network Performance Optimisation
Business Unit / Department: Network Operations
Business Unit Data Steward: [Insert name and title — Network Operations Data Steward]
Description of Processing:
NTP processes aggregated and individual subscriber network usage data to optimise network performance, plan capacity upgrades, and identify and resolve service degradation across its UK telecommunications network. The processing involves the following data and operations:
Data collected: Call metadata (call initiation and termination times, duration, originating and terminating cell sectors — but not the content of communications), data session records (session start and end times, data volume transferred, serving cell sector), cell tower handover data (records of handovers between cell sectors during active sessions), signal quality metrics (signal-to-interference-plus-noise ratio, reference signal received power, channel quality indicators), and device type information (device manufacturer and model category, operating system version).
Data source: Personal data is generated automatically by NTP's network infrastructure as subscriber devices interact with the network. Data is collected from network elements including base stations, radio network controllers, mobility management entities, and packet data gateways.
Processing operations: Data is collected in near-real-time and ingested into NTP's Network Performance Management ("NPM") platform, hosted in NTP's London data centre. Within the NPM platform, subscriber identifiers (specifically, IMEI numbers) are hashed using a one-way cryptographic hash function before the data is made available for analysis. Network engineers access pseudonymised datasets through the NPM platform's analytical tools to identify patterns of service degradation, diagnose network faults, model capacity requirements, and plan infrastructure investments.
Outputs: The outputs of the processing are network performance reports, capacity planning models, fault diagnosis alerts, and infrastructure investment recommendations. These outputs are used by NTP's network engineering teams and infrastructure planning function to make operational and capital expenditure decisions. The outputs do not identify individual subscribers and are not used for marketing, profiling, or any purpose unrelated to network performance management.
Retention: Pseudonymised individual-level data is retained for a period of twelve (12) months from the date of collection, after which it is automatically deleted from the NPM platform. Aggregated, non-personal statistical data derived from the processing may be retained indefinitely for trend analysis and historical benchmarking.
Data Subject Categories: Consumer subscribers (approximately 6.3 million individuals across NTP's UK operations).
Categories of Personal Data:
•  Subscriber metadata (call detail records and data session records — not the content of communications)
•  Cell-tower location data (approximate cell-sector level location, not precise GPS coordinates)
•  Device identifiers (IMEI numbers, pseudonymised via cryptographic hashing before analysis)
•  Session duration and data throughput metrics
•  Signal quality metrics
•  Device type and operating system information
Special Category Data Involved: No. The processing does not involve any special categories of personal data as defined in Article 9(1) of the GDPR.
Internal Recipients:
•  Network Operations department (network engineers and analysts with authorised access to the NPM platform)
•  Infrastructure Planning function (access to aggregated outputs only)
•  CISO function (audit and security oversight access)
External Recipients / Processors: None. The NPM platform is operated in-house on NTP's own infrastructure. No personal data is shared with external third parties in connection with this processing activity.
International Transfers: No. All processing is conducted in NTP's London data centre within the United Kingdom.
7.2 Part B — Three-Part Test (Worked Example)
Part 1 — Purpose Test
4.1.1 — What is the legitimate interest being pursued?
NTP has a legitimate commercial and operational interest in optimising the performance of its telecommunications network to provide reliable, high-quality services to its consumer subscribers. Network optimisation is essential to NTP's ability to maintain competitive service quality, comply with its regulatory obligations as a licensed telecommunications operator under Ofcom's General Conditions of Entitlement, and meet the reasonable expectations of its subscribers for reliable mobile and data connectivity. Specifically, the legitimate interest comprises:
(a) Service quality maintenance and improvement: Identifying and resolving network faults, congestion, and service degradation to ensure that subscribers receive the level of service quality that they expect and that NTP is contractually and regulatorily obligated to provide.
(b) Capacity planning: Analysing patterns of network demand to plan and prioritise capital investments in network infrastructure (e.g., deployment of new base stations, upgrade of existing equipment, spectrum refarming) in a manner that is targeted, efficient, and responsive to actual subscriber usage patterns.
(c) Subscriber benefit: Network optimisation directly benefits subscribers through improved call quality, reduced dropped connections, faster data speeds, and more consistent coverage. The interests of the controller and the data subjects are therefore substantially aligned.
4.1.2 — Whose legitimate interest is it?
Both the controller's (NTP's commercial and operational interest in operating an efficient and high-quality telecommunications network) and the data subjects' (consumer subscribers benefit directly from improved network performance, reliability, and coverage).
4.1.3 — Is the interest lawful?
Yes. Network optimisation is a standard, lawful, and expected activity for a regulated telecommunications operator. It is consistent with NTP's obligations under Ofcom's General Conditions of Entitlement and does not conflict with any applicable law, regulation, or industry code of practice. The processing of network metadata (as distinct from the content of communications) for network management purposes is expressly recognised as a legitimate activity under the Privacy and Electronic Communications Regulations 2003 and the ePrivacy framework.
4.1.4 — Is the interest sufficiently clearly articulated?
Yes. The interest is specifically and clearly articulated as the analysis of network performance data to: (a) identify and resolve service quality issues, including congestion, dropped connections, and coverage gaps; and (b) plan and prioritise capital investments in network infrastructure based on actual subscriber usage patterns. This is not a vague or generic "business purpose" but a specific, identifiable operational objective.
Part 2 — Necessity Test
4.2.1 — Is the processing necessary for the stated purpose?
Yes. Effective network optimisation requires analysis of individual subscriber session data