If you run outbound in Europe, you’ve probably heard the term “legitimate interest” thrown around. It’s the legal basis that B2B companies rely on when they send cold emails: the argument that you have a reasonable, balanced reason to process someone’s data for outreach purposes.

What’s less commonly discussed is the Legitimate Interest Assessment (LIA), the structured exercise of actually documenting that argument. Even if it’s not strictly required where you operate, having one makes life a lot easier if anyone ever asks you to justify your outreach.

Disclaimer: This is not legal advice. If you need legal guidance on GDPR compliance, talk to a lawyer.

What is an LIA?

An LIA is a documented assessment that walks through three tests:

1. Purpose test. What is the legitimate interest you’re pursuing? For outbound, this is typically “identifying and contacting businesses that would benefit from our product/service.”

2. Necessity test. Is processing personal data necessary to achieve this purpose? Could you achieve the same result without it? (Usually the answer is: no, you need at least an email address and a name.)

3. Balancing test. Does your interest override the individual’s rights and expectations? This is where most of the nuance lives. You need to consider whether the person would reasonably expect to be contacted, whether the data is sensitive, and what safeguards you have in place.

Do you actually need one?

Technically, in many EU jurisdictions, there’s no statutory requirement to formally document an LIA before relying on legitimate interest. But if a data subject complains, or if a DPA comes asking questions, you’ll need to explain your reasoning. Having it written down in advance beats trying to reconstruct it after the fact.

In the UK (post-Brexit), the ICO explicitly recommends conducting an LIA. It’s considered best practice even where it’s not mandated.

Where outbound teams get stuck

The balancing test is where B2B outbound teams struggle. You need to show that your outreach is targeted and proportionate to a real business need. “We bought a list and emailed everyone on it” is a bad answer. “We identified companies matching specific criteria, evaluated each one against our qualification logic, and only contacted those where we had a clear reason to believe our product was relevant” is a much better one. Building that kind of deep, testable ICP is what makes this argument credible.

The problem is that few teams have the evidence trail to back up the second claim. They know they did some research. They know they had a reason. But it’s locked in someone’s head, or scattered across a CRM note and a Slack thread.

Building the evidence trail

This is where structured qualification starts pulling double duty for compliance.

If your qualification process produces structured, persistent evidence for each lead (what questions were asked, what the answers were, what logic was applied, what the outcome was), then you already have most of what an LIA needs for the balancing test.

Consider what a well-documented qualification record looks like:

• Qualifier questions evaluated: “Is this a B2B company?” “Do they have an outbound sales function?” “Are they in a vertical we serve?” “Is the contact a decision-maker for sales tooling?”
• Results per qualifier: Yes, Yes, Yes, Yes — with evidence (company website, LinkedIn profile, job postings).
• Logic applied: All four qualifiers must pass.
• Outcome: Qualified — proceed to outreach.
• Timestamp: When the evaluation happened.

That record, for each lead, is the substance of your balancing test. It shows that you had a specific, documented reason to believe this contact was relevant.

What an LIA looks like in practice

A practical LIA for outbound doesn’t need to be a 40-page legal document. For most B2B use cases, it’s a few pages covering:

1. Description of processing: “We source company and contact data from [providers], evaluate it against our qualification criteria, and contact qualified prospects via email.”
2. Legitimate interest: “Identifying and engaging businesses that would benefit from [your product].”
3. Necessity: “We need to process contact names and business email addresses to conduct outreach.”
4. Balancing: “We only contact individuals where structured qualification demonstrates relevance. Our process produces an evidence record for each lead. We provide opt-out in every communication. We do not contact individuals using personal email addresses.”
5. Safeguards: Opt-out mechanisms, data retention policies, qualification evidence retention.

The tooling angle

You can do all of this manually. Many teams do — they document their LIA once, update it annually, and keep qualification records in their CRM.

But if you want the evidence trail to be automatic and consistent, that’s where tooling helps. BDR² (here’s how it works) was designed around this idea: qualification produces evidence, evidence is persisted, and the whole chain from qualifier logic to accept/reject decision is auditable. The tool doesn’t make you compliant (compliance is always on you). It just makes the evidence trail a byproduct of doing qualification well instead of something you have to bolt on later.

Practical takeaways

• If you rely on legitimate interest for outbound in the EU/UK, write down your LIA. Even a short one is better than none.
• Structure your qualification so it produces evidence, not just a yes/no.
• Keep records of why each lead was contacted — this is the core of the balancing test.
• Review and update your LIA when your targeting changes. It should evolve with your process.

None of this is exciting work. But it’s the kind of boring homework that lets you scale outbound without worrying that one complaint will unravel the whole operation.