Although it was already implemented in the practice of most national Data Protection Authorities, no unified guidelines have been issued since the entry into force of the GDPR on “legitimate interest” as a lawful basis for processing personal data.