Right to object

Article 21 GDPR allows a data subject to object to processing based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions, where the objection relates to the data subject’s particular situation. The controller must stop processing unless it demonstrates compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or the processing is needed for the establishment, exercise or defence of legal claims.

Direct marketing is subject to a stronger rule. A data subject may object at any time to processing for direct marketing, including related profiling. The data must then no longer be processed for those marketing purposes. The controller must draw attention to this right at the latest when first communicating with the data subject, in a clear and separate form. An objection does not automatically require erasure if another lawful reason supports retaining the data.

Businesses should record the purpose, legal basis, recipients and systems affected by an objection and coordinate the response across the relevant processes. The overview of data subject rights and access explains the wider handling of requests. The marketing, cookies and tracking page covers advertising and profiling, while privacy compliance and governance helps organise responsibilities and evidence.