“Legitimate business interest” is one of several legal bases to process data articulated by the EU’s General Data Protection Regulation (GDPR) – and probably the least understood. The Article 29 Working Party issued an Opinion in 2014 about legitimate interests (which was also a provision of the EU’s 1995 Directive on data protection) that can help companies understand this provision and use it appropriately for GDPR compliance. We provide an excerpted version of the Opinion here.