You can object to certain processing, but whether the organisation must stop depends on the legal basis and purpose.
Article 21 gives a right to object in specified circumstances. The right is absolute for direct marketing. For processing based on public task or legitimate interests, the controller may continue only if it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
Withdrawing consent is separate: if consent is the lawful basis, you can withdraw it without needing to frame the request as an Article 21 objection.
Key points
- Direct marketing objection: the organisation must stop using your data for that marketing.
- Legitimate-interests/public-task objections require a balancing/grounds analysis.
- State your particular circumstances where relevant.
- Restriction can be requested while some objections are being considered.
Direct marketing
If personal data is processed for direct marketing, including related profiling, the right to object is absolute. The controller can retain a minimal suppression record to ensure it does not start marketing to you again.
Legitimate interests and public task
Explain the impact on you and why your circumstances weigh against the processing. The controller must stop unless it can demonstrate the required compelling grounds or legal-claims necessity.
Objection versus complaint
An objection asks the controller to stop specified processing. A complaint can separately allege that the processing was unlawful, unfair or poorly handled. You may need both.
In practice
- Identify the processing activity, not just the organisation.
- Say whether the objection is to direct marketing or another Article 21 category.
- For non-marketing objections, explain the personal impact.
What to do
A practical next-step plan
- Identify the lawful basis/purpose.
- Send a clear objection.
- Request restriction if appropriate while it is considered.
- Keep the decision and reasons.
- Escalate if the controller continues without a lawful basis.
Common traps
Things that often confuse the issue
- Objecting is not the same as withdrawing consent.
- The right is not absolute for every kind of processing.
- A suppression list can lawfully retain limited data to honour a marketing objection.
Evidence worth keeping
An objection can be paired with restriction while it is decided.
Where you object under the relevant Article 21 ground, restriction may apply while the controller verifies whether its legitimate grounds override yours. This can matter where the processing is actively affecting decisions or disclosures.
Useful wording.
“I object to the processing of [data] for [purpose]. Your privacy information indicates the basis is [legitimate interests/public task]. My particular circumstances are [briefly explain]. Please restrict the disputed processing while you determine the objection and, if you refuse, identify the overriding grounds relied upon.”
Explain your circumstances rather than sending a generic “I object”.
For non-marketing objections, describe the harm, intrusion or particular situation that makes the processing objectionable to you. Ask the organisation to identify its lawful basis and, if it refuses, the compelling legitimate grounds it says override your interests, rights and freedoms.
| Situation | What to say |
|---|---|
| Direct marketing | “I object to processing of my personal data for direct marketing. Stop that processing.” |
| Legitimate interests | Explain your particular situation and ask for the balancing/overriding grounds. |
| Public task | Explain your particular situation and challenge necessity/grounds. |
| Consent | Withdraw consent rather than relying only on objection. |
Withdrawing consent is different and usually simpler.
If the organisation is relying on your consent, you do not need to construct a legitimate-interests objection; you can withdraw consent. The controller must then stop processing based on that consent unless another lawful basis legitimately applies to the processing in question. Ask the organisation to identify the lawful basis if it says withdrawal makes no difference.
The strength of the right depends on why the organisation is processing the data.
The right to object is particularly relevant where processing relies on legitimate interests or public task/official authority. In those situations the controller must consider your particular circumstances and, depending on the ground, may continue only where it can establish the required overriding grounds. If the processing is direct marketing, the right to object is effectively absolute: the marketing use must stop.
Official sources
Check the rules behind this guide
ConsumerWise explains these materials in plain English. Check the current official source where a deadline, rule about what the body can deal with or legal requirement may have changed.