One Identity claims it has a legitimate business reason to send you marketing emails and contact you about its products without needing your explicit consent, as long as it believes the communications are relevant to your professional role.
This analysis describes what OneLogin's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Using 'legitimate interests' as a legal basis for marketing means One Identity may contact you without asking for consent first, but you have the right under GDPR and UK GDPR to object to this processing at any time.
The updated policy discloses that OneLogin may record calls with consent and use AI to analyze call transcripts, chat conversations, and sales emails for multiple purposes including follow-up task id…
One Identity may send you unsolicited marketing communications based on its own assessment that this is in its legitimate business interests, without obtaining your prior consent — though you can object to this processing and request it stops.
Cross-platform context
See how other platforms handle Legitimate Interests as Legal Basis for Marketing and similar clauses.
Compare across platforms →Monitoring
OneLogin has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We rely on our legitimate interests to process your personal information for business development and marketing purposes, including to send you information about our products, services, and events that we believe may be of interest to you as a business professional.— Excerpt from OneLogin's OneLogin Privacy Policy
REGULATORY FRAMEWORK: GDPR Art. 6(1)(f) permits processing based on legitimate interests only where those interests are not overridden by the data subject's rights and freedoms. GDPR Art. 21 grants an absolute right to object to processing for direct marketing. UK GDPR mirrors these provisions. The UK ICO and EDPB have issued guidance indicating that direct marketing to individuals requires a Legitimate Interests Assessment (LIA) and that consent is often the more appropriate basis. PECR (Privacy and Electronic Communications Regulations 2003) in the UK may additionally require prior consent for electronic marketing.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Using 'legitimate interests' as a legal basis for marketing means One Identity may contact you without asking for consent first, but you have the right under GDPR and UK GDPR to object to this processing at any time.
One Identity may send you unsolicited marketing communications based on its own assessment that this is in its legitimate business interests, without obtaining your prior consent — though you can object to this processing and request it stops.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OneLogin.