Legitimate Interests Assessment (LIA)
In practice, for a UK buyer
The paragraph above is the neutral answer. This is the part a vendor glossary leaves out.
The document a data protection officer will ask for first when a plan relies on legitimate interests, and the one most advertisers discover they do not have. AdBuyMCP surfaces the requirement as a condition on the compiled plan rather than leaving it to be discovered in a review, but producing the assessment is the advertiser's obligation.
What this one connects to
Most confusion in media buying comes from two adjacent terms being used interchangeably, so these are the neighbours worth reading next.
Legitimate interests
A lawful basis permitting processing necessary for interests pursued by the controller or a third party, provided those interests are not overridden by the rights of the individual. Requires a documented balancing assessment.
Lawful basis
The legal ground relied on to process personal data, of which six exist under UK GDPR and at least one must be identified before processing begins. In advertising the two that matter are consent and legitimate interests, and the basis has to be settled before the processing, not after.
Data Protection Impact Assessment (DPIA)
A structured assessment of the privacy risks of a processing activity, required where processing is likely to result in a high risk to individuals — which large-scale profiling for advertising generally is.
UK GDPR
The United Kingdom's data protection regime, retaining the structure of the EU General Data Protection Regulation. Requires a lawful basis for processing personal data and gives individuals rights over data about them.
More on compliance and clearance
UK data protection and UK advertising clearance: what has to be true before an ad runs.
45 minutes. Bring a real brief and we compile it live. You describe one audience and watch it compile into seven targeting specifications, each with the score for how much of the definition survived.
Talk it through