Legitimate Interests Assessment

Why I was allowed to email you.

If I wrote to your company out of the blue, the law says I have to have thought about it first, written down what I concluded, and be able to show you. Most people who do this keep that document in a drawer. Here is mine.

Assessed 8 September 2026 · next review 8 September 2027 · signed copy held on file

1. What the processing actually is

Workings is a one-person consultancy taking on a small number of clients — three at a time. To find them it approaches a hand-built list of around fifty owner-managed limited companies in South Wales.

For each company the following is recorded:

• Company name and registered number, from the Companies House public register.
• Town of the registered office, and the accounts type filed — a public proxy for company size.
• The company's website address.
• A general business email address — sales@, info@, enquiries@ — taken from that company's own published website. Never guessed, never inferred, never supplied by a data broker.
• The name of a current director as it appears on the public register, so the email can be addressed to a person rather than to nobody.
• A short note on why the company might be a fit.

No special category data is involved. No personal email addresses, direct phone numbers, home addresses, or information about anybody's private life are collected. No list is purchased, no social network is scraped, and no enrichment or address-guessing tool is used.

2. Purpose test — is there a legitimate interest?

Yes, and on both sides.

The controller's interest. Finding the small number of clients the business is built to take. The category has almost no inbound search demand to work with — on my own keyword research, around 140 relevant searches a month across the whole of the UK. Direct approach is not a shortcut past marketing; realistically it is the only route there is.

The recipient's interest. The companies approached are stock-heavy owner-managed firms carrying a substantial and largely invisible manual-admin cost. Hearing from someone who has solved the same problem in his own trading business is of genuine potential value to them. This is not a case where only the sender benefits.

Third-party interest. None relied upon.

The interest is lawful, is clearly articulated, and is not trivial or speculative.

3. Necessity test — is the processing necessary?

Yes. To write to a company at all, a name and an address to send to are required; there is no version of this that uses less data. The question is therefore whether a less intrusive route to the same end exists.

• Advertising and search reach a category with almost no buying-intent search volume, and cannot be pointed at the specific fifty firms identified.
• Waiting for referrals is not a plan and does not scale to a first client.
• Buying a prepared list would involve considerably more personal data, of unverified provenance, and was rejected for that reason.

What is held is the minimum needed: public company identity, a published general email address, and one director name so the message can be properly addressed. Nothing is collected that is not used.

4. Balancing test — do your interests override mine?

Nature of the data. Low-sensitivity business contact data, already published by the company itself or filed on a public statutory register. A director's name on the Companies House register is personal data, but it is data that person is legally required to make public in that capacity. No special category data, no criminal offence data, nothing relating to children.

Reasonable expectations. A limited company that publishes a general enquiries address on its own website expects that address to receive business enquiries; that is its stated function. A director listed on the public register can reasonably expect to be identified as a director. Receiving one relevant, individually written approach from a named local business owner falls squarely inside what a business would expect. It would be different if the message were automated, repeated, disguised, or sent to a personal address — none of which applies here.

Likely impact. Minimal. One email, to a business address, deletable in a second. No profiling, no automated decision-making, no tracking pixel, no scoring of recipients, no enrichment against other datasets, and no disclosure to any third party. The realistic worst case is a mild nuisance.

Safeguards applied.

• One email only. No follow-up sequence, and no repeated “bumps”.
• Written individually and specific to the recipient's business — no mail-merged template sent at volume.
• Sender identified by name, with trading name, company number and registered office, and a reply-to that a human reads.
• An unconditional opt-out in every message, acted on the same day, no reason asked for.
• A suppression list holding email addresses only, kept indefinitely for one purpose: preventing re-contact.
• Prospect records deleted after 12 months, or immediately on request.
• A public transparency notice at theworkings.uk/privacy explaining where the data came from, satisfying UK GDPR Article 14, and linked from the email itself.
• Limited companies only. Sole traders and ordinary partnerships are excluded by design.

Conclusion. The recipient's interests and rights do not override the legitimate interest. The data is business data, the volume is tiny, the intrusion is slight and non-repeating, objection is immediate and absolute, and the recipient is told plainly where the data came from.

5. The PECR position

PECR regulation 22, which requires prior consent for unsolicited marketing by electronic mail, applies to individual subscribers. Limited companies are corporate subscribers and fall outside it, so consent is not required for these messages. That is precisely why the list is restricted to limited companies: sole traders and ordinary partnerships are treated as individuals and would have to have opted in first.

PECR regulation 23 applies regardless of subscriber type. The sender's identity is not concealed, and a valid opt-out address is given in every message. Both requirements are met.

A DPIA is not required. The processing is not large-scale, involves no systematic monitoring, no special category data, and no profiling or automated decision-making, and does not meet any of the ICO's listed high-risk criteria.

6. Outcome

This assessment must be revisited before any material change — sending sequences rather than single emails, materially increasing volume, adding sole traders or partnerships, buying in data, or introducing tracking or automated personalisation. Any of those changes the balance, and this document would no longer support the activity.

Signed and dated by Graham, director, Loaded Dice Ltd. The signed copy is held on file and is the version of record; this page reproduces it in full.