@fooflington that’s 6.1 b) and c) of the GDPR.

Legitimate interest is 6.1 f) and is much more fuzzily defined and a subject of many a lawsuit.

One example that comes to mind is that the Spanish DPA allows for processing the name and professional contact details of a person in another company with whom your company has a business relationship under legitimate interest, which doesn’t explicitly fall under a contractual obligation.

Another might be a company holding onto a job applicant’s data if they feel they may be suitable for a future posting not currently available.

Fraud prevention is something explicitly mentioned in the recitals of the GDPR as legitimate interest too.

Marketing? Online cookie stuff? Very very thin ice as legitimate interest. I certainly don’t consider it valid, and have advised companies of mine as such, as a DPO.