On Marketing as a Legitimate Interest
NPC Advisory No. 2023-16 states:
In the current matter, the legitimate interest of the company is to be able to initiate marketing communications with potential customers to sell its products and services. As such, the company must establish: first, that the processing shall be for the sole purpose of pursuing the legitimate interest of the company, which is to be able to send marketing communications about its products and services to potential customers; second, the processing shall only be limited to the personal information necessary and proportionate to achieve its legitimate interest. Hence, only personal information which is necessary for the company to be able to contact the potential customers must be processed. Third, the processing of personal information must be done in the least intrusive way so as not to impede the rights of the data subjects.
Recital 47, GDPR:
The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.