Skip to main content
Digital Compliance Bureau
Promotional banner for the pentest readiness checklist
Category: Data Subject Rights

Right to Object

Also known as: Right to object to processing, Objection right
Simply put

The right to object lets an individual ask an organisation to stop using their personal data in certain situations. It generally applies at any time and, depending on the circumstances, can require the organisation to halt the processing unless it can show a strong enough reason to continue. It does not apply to every kind of data use, and whether an objection succeeds depends on the specific facts.

Formal definition

A data subject right established under the EU GDPR (Article 21) and mirrored in the UK GDPR, permitting a data subject to object, on grounds relating to their particular situation, to processing of their personal data in certain circumstances. The right is not absolute: in most cases it applies to processing based on particular lawful bases, and where an individual objects on situational grounds the controller must generally cease processing unless it can demonstrate compelling legitimate grounds that override the individual's interests, rights, and freedoms, or that the processing is needed for the establishment, exercise, or defence of legal claims. Its exact scope, exemptions, and the assessment of a valid 'particular situation' are fact-specific and should be verified against the current authoritative text and regulator guidance (for example, the ICO in the UK and the European Commission or supervisory authorities in the EU). This entry does not address processing for direct marketing, which is treated distinctly.

Why it matters

The right to object is a core data subject right under the EU GDPR (Article 21) and the mirrored UK GDPR. It gives individuals a mechanism to challenge how organisations use their personal data, shifting the burden onto the controller to justify continued processing when a valid objection is raised. For organisations, this means an objection is not a routine request that can be dismissed; in certain circumstances it can require processing to stop unless the controller can demonstrate compelling legitimate grounds or a need to establish, exercise, or defend legal claims.

The right matters because it is not absolute and is highly fact-specific. Whether an objection succeeds depends on the lawful basis relied upon, the individual's particular situation, and the outcome of a balancing assessment. This creates operational and legal exposure for organisations that cannot document their grounds for processing or respond to objections in a structured, defensible way. Misclassifying an objection, ignoring it, or failing to conduct a proper assessment can expose an organisation to regulatory scrutiny from supervisory authorities such as the ICO in the UK or the relevant EU supervisory authorities.

Because the exact scope, exemptions, and the assessment of what constitutes a valid 'particular situation' are fact-specific and evolving, organisations should treat each objection as an individual determination rather than applying a blanket rule. This entry is informational and does not address processing for direct marketing, which is treated distinctly; readers should verify obligations against the current authoritative text and regulator guidance.

Who it's relevant to

Data Protection Officers and Privacy Teams
DPOs and privacy professionals are responsible for designing processes to receive, assess, and respond to objections within the required timeframes. They need to ensure the organisation can identify the lawful basis for a given processing activity, conduct and document the balancing assessment, and determine whether compelling legitimate grounds or a legal-claims justification applies.
Legal and Compliance Counsel
Legal and compliance staff advise on whether an objection must be upheld, evaluate the strength of any 'compelling legitimate grounds' argument, and assess exposure where processing is needed for the establishment, exercise, or defence of legal claims. Because outcomes are fact-specific, application to particular circumstances requires professional judgment.
Controllers Relying on Situational Lawful Bases
Organisations acting as controllers, particularly where processing rests on lawful bases to which the right applies, must be able to respond to objections raised on grounds relating to an individual's particular situation. They bear the burden of demonstrating grounds to continue processing where they choose not to stop.
Individuals and Data Subjects
Individuals in the EU or UK may exercise this right to ask an organisation to stop using their personal data in certain circumstances and at any time. Whether an objection succeeds depends on the specific facts and the controller's ability to justify continued processing.

Inside Right to Object

Data subject's right to object
Under the EU GDPR, the right to object allows a data subject to challenge the processing of their personal data in defined circumstances, generally where processing is based on legitimate interests, the performance of a task carried out in the public interest, or the exercise of official authority. It is distinct from the right to erasure and the right to restriction of processing, though these rights may interact.
Direct marketing objection
Where personal data is processed for direct marketing purposes, the data subject generally has an absolute right to object at any time, after which the controller must stop processing the data for those purposes. This is typically treated as a stronger, unconditional right compared with objections to other forms of processing.
Legitimate interests balancing
For processing grounded in legitimate interests or public-interest tasks, an objection does not automatically end processing. The controller must generally cease unless it can demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, or that processing is necessary for the establishment, exercise, or defence of legal claims.
Controller obligations
The controller, as the party determining the purposes and means of processing, is responsible for handling objections. This includes informing data subjects of the right at the point of first communication and, where applicable, assessing whether overriding grounds exist. A processor acting on the controller's behalf does not independently determine the outcome of an objection.
Jurisdictional scope
The right to object as described here derives from the EU GDPR and applies to controllers and processors within its territorial and extraterritorial scope. Comparable but not identical rights may exist under the UK GDPR and certain other regimes; other jurisdictions, including sectoral frameworks in the United States, may address objection or opt-out differently or not at all. Requirements should be verified against the applicable law.

Common questions

Answers to the questions practitioners most commonly ask about Right to Object.

Does the right to object mean a data subject can always stop an organization from processing their personal data?
No. The right to object is not an absolute right to halt all processing. Under the GDPR, it generally applies to specific processing bases—most notably processing carried out for the performance of a task in the public interest or in the exercise of official authority, and processing based on legitimate interests, as well as direct marketing and certain profiling. Where the objection concerns direct marketing, the controller must stop that processing. For other grounds, the controller may continue processing if it can demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, or where the processing is needed to establish, exercise, or defend legal claims. The right also does not extend to processing based on other lawful bases such as consent or contractual necessity, which are addressed through different mechanisms. Application to a specific situation depends on the facts and requires professional judgment; verify against the current official text.
Is the right to object the same as the right to erasure or the right to withdraw consent?
No—these are distinct rights that are often confused. The right to object challenges the lawfulness or appropriateness of ongoing processing on particular grounds and may require the controller to cease processing unless it can show overriding legitimate grounds. The right to erasure (the so-called right to be forgotten) concerns deletion of personal data and applies under its own separate conditions, though a successful objection can in some cases trigger erasure. The withdrawal of consent applies only where consent was the lawful basis for processing and operates prospectively without needing to demonstrate any particular ground. Keeping these apart matters because they attach to different lawful bases and carry different obligations for the controller. This entry does not cover the detailed conditions for erasure or consent withdrawal.
How should an organization handle an objection made on grounds relating to the data subject's particular situation?
For objections to processing based on legitimate interests or on public-interest/official-authority grounds, the GDPR generally requires the objection to relate to the data subject's particular situation. In most cases the controller should assess whether it can demonstrate compelling legitimate grounds that override the individual's interests, rights, and freedoms, or whether the processing is necessary for legal claims. This typically involves a documented balancing analysis and a timely response to the data subject. If no overriding grounds exist, processing of that data should generally stop. The specifics of the assessment and response timelines should be verified against the current official text and any applicable supervisory authority guidance.
What are the obligations when a data subject objects to direct marketing?
Where the objection concerns processing for direct marketing purposes, the position is generally stronger than for other grounds: the controller must stop processing the personal data for that purpose, and no balancing test applies. This is commonly described as an unconditional right in the direct marketing context. Organizations typically need mechanisms to record such objections and to ensure the individual is suppressed from future marketing activity, including related profiling to the extent it relates to direct marketing. Note that sector-specific rules on electronic communications and marketing may impose additional or parallel requirements depending on the jurisdiction; verify against the applicable local rules.
How does an organization inform individuals about the right to object?
The GDPR generally requires that the existence of the right to object be brought to the data subject's attention clearly and separately from other information, and at the latest at the time of first communication where relevant—particularly for direct marketing. In practice this is often addressed through privacy notices and, for marketing, through clear opt-out mechanisms in communications. The precise presentation and timing obligations depend on the processing context and should be confirmed against the current official text and applicable supervisory guidance. This entry does not prescribe specific notice wording.
Should organizations document how they respond to objections?
As a general practice, organizations rely on records to demonstrate accountability, which is a broad principle underpinning data protection compliance. Documenting the receipt of an objection, any balancing assessment performed, the decision reached, and the resulting action supports the ability to demonstrate that the objection was handled in accordance with applicable requirements. The appropriate level of documentation is fact-specific and may vary with the processing ground and risk involved. Organizations should align record-keeping practices with the current official text and relevant supervisory authority expectations rather than treating any single approach as definitive.

Common misconceptions

The right to object gives the data subject an absolute right to stop all processing.
The right is generally absolute only for direct marketing. For processing based on legitimate interests or public-interest tasks, the controller may continue if it can demonstrate compelling legitimate grounds that override the data subject's interests, or where processing is needed for legal claims. The outcome is therefore fact-specific.
The right to object is the same as the right to erasure or to withdraw consent.
These are distinct rights. Objection challenges the lawfulness or continuation of processing in specific grounds and may not require deletion. Withdrawal of consent applies where consent is the legal basis, which is a different basis from legitimate interests. Erasure is a separate right that may or may not follow from a successful objection.
This right applies universally across all jurisdictions in the same way.
The right to object as framed here is a feature of the EU GDPR. The UK GDPR contains a broadly similar right, but other jurisdictions may use different mechanisms such as opt-out rights, or may not provide an equivalent. Practitioners should confirm the applicable regime and its current text.

Best practices

Inform data subjects of their right to object clearly and separately at the point of first communication, particularly where processing relies on legitimate interests or is used for direct marketing.
Where an objection to direct marketing is received, cease processing personal data for those purposes promptly and suppress rather than delete the record where needed to honour the objection going forward.
For objections to legitimate-interest or public-interest processing, document a case-specific balancing assessment before deciding whether compelling overriding grounds exist, rather than applying a blanket policy.
Establish a defined intake and response workflow so objections are recognised, routed to the controller function, and actioned within applicable timeframes, and keep an auditable record of the decision and its rationale.
Distinguish objection requests from related requests such as erasure, restriction, or consent withdrawal, and handle each under its correct legal basis to avoid conflating separate rights.
Verify obligations against the current text of the applicable regime (for example the EU GDPR, UK GDPR, or relevant sectoral law) and seek professional judgement for particular circumstances, as interpretations and enforcement practice may evolve.
Promotional banner for the Penetration Report Template Kit