“Legitimate business interest” is one of several legal bases to process data articulated by the EU’s General Data Protection Regulation (GDPR) – and probably the least understood.