GDPR Legitimate Interest Assessment (LIA) — Guided assessment for Art. 6(1)(f) GDPR using the EDPB three-step test. Based on EDPB Guidelines 1/2024, EDPB Opinion 28/2024 (AI models), the OSS Case Digest on Legitimate Interest (McIntyre 2026), CNIL AI guidance (June 2025), ICO guidance, and key CJEU case law.
NewMaintained
Automatic
◆Legal & Contracts pack
Last verified 8/16/2026
What it changes
Passed 7 of 21 test cases with the skill, and 14 of 21 without it.
Without skill67%
With skill33%
Checks it passed that the model alone missed
States that a controller cannot claim data subjects' own interests as its legitimate interest under Article 6(1)(f).
1 fixed13 passed either way3 still failing5 broke
Pass-rate lift
-33 pp
Tokens
+270%
Agent turns
0%
Response time
-15%
Model gemini-3.6-flashMeasured 8/16/2026v114 of 22 cases passed with skill · 21 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
A mobile identity application collects user biometric data under Article 6(1)(f), arguing that its primary legitimate interest is serving as a legal custodian protecting the privacy and financial security of the data subjects. Evaluate whether acting as a custodian for data subjects satisfies Step 1.
What was checked, without and with the skill
Checked
Without skill
With skill
States that a controller cannot claim data subjects' own interests as its legitimate interest under Article 6(1)(f).
Missed
Passed
case-08 · gemini-3.6-flash · 8/16/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md453 lines10 files
GDPR Legitimate Interest Assessment (LIA)
Guide users through a comprehensive Art. 6(1)(f) GDPR assessment using the EDPB three-step test, producing a documented Legitimate Interest Assessment (LIA) suitable for accountability records.
EDPB Guidelines 1/2024 on processing based on Art. 6(1)(f) GDPR (adopted 8 October 2024) — the core interpretive document
EDPB Opinion 28/2024 on AI models and processing of personal data (17 December 2024) — AI-specific LIA guidance; see [references/additional-regulatory-sources.md] §1
EDPB OSS Case Digest on Legitimate Interest (March 2026, Dr. TJ McIntyre) — 62 OSS decisions + 5 EDPB binding decisions analysed; see [references/oss-enforcement-practice.md]
CNIL Recommendations on Legitimate Interest for AI Development (19 June 2025) + companion web scraping focus sheet — the most operationally detailed national guidance on AI + LI; see [references/additional-regulatory-sources.md] §2
UK ICO Legitimate Interests Guidance (updated 23 March 2026) — includes DUA Act 2025 "Recognised Legitimate Interest" new basis; note divergent necessity standard; see [references/additional-regulatory-sources.md] §3
WP29 Opinion 06/2014 on legitimate interests under Art. 7 Directive 95/46/EC (not formally endorsed by EDPB, but still referenced)
DSK Joint Guidance "AI and Data Protection" (6 May 2024) — German DPA unified position