The GDPR Right to Object: How to Stop Organizations Using Your Data

The right to object under the GDPR, in Article 21, lets you tell an organization to stop using your personal data in certain ways. If the processing is for direct marketing, your objection is absolute: the organization must stop, with no balancing test. If it relies on “legitimate interests” or a public task, it must also stop unless it can show compelling legitimate grounds that override your interests, rights and freedoms, or it needs the data for legal claims.

This guide explains when you can object, how to do it and what happens next. The UK GDPR contains the same right. It’s general information, not legal advice.

What the right to object covers

Under the GDPR, every use of personal data needs a lawful basis. The right to object doesn’t apply to all of them, so the first question is which basis the organization is using. Its privacy notice should tell you.

Lawful basis the organization relies on	Can you object under Article 21?
Direct marketing (whatever the basis)	Yes, and the objection is absolute
Legitimate interests	Yes, on grounds relating to your particular situation
A task in the public interest or official authority	Yes, on grounds relating to your particular situation
Scientific, historical research or statistics	Yes, unless the processing is necessary for a public interest task
Consent	No, but you can withdraw consent at any time, which has a similar effect
A contract with you, a legal obligation, or vital interests	No

If the organization is relying on consent, you don’t need Article 21. Withdrawing consent should be as easy as giving it, and processing on that basis has to stop from that point, though earlier processing stays lawful.

Direct marketing: the absolute right

If an organization uses your data for direct marketing, you can object at any time and it must stop processing your data for that purpose. It can’t argue that its business interests outweigh yours. The same applies to profiling linked to direct marketing, such as building a profile of you to target ads or offers.

Organizations must tell you about this right explicitly, clearly and separately from other information, at the latest when they first communicate with you. For online services, you can also object by automated means, for example through technical settings, where the service supports it.

A few practical points:

• Stopping marketing doesn’t always mean deleting everything. The organization can usually keep a minimal record, such as your email address on a suppression list, so it knows not to contact you again.
• Electronic marketing has extra rules. Marketing emails, texts and calls are also governed by e-privacy law in the EU and, in the UK, by the Privacy and Electronic Communications Regulations. These often require consent in the first place.
• Every message should give you a way out. An unsubscribe link counts as an objection, but a direct written objection is clearer if the marketing continues.

Legitimate interests and public tasks: the qualified right

Many organizations process data because it serves their “legitimate interests”, such as fraud prevention, analytics or running a directory. Public bodies often rely on a public task. For both, you can object on grounds relating to your particular situation.

Once you object, the burden shifts. The organization must stop unless it can demonstrate either:

1. compelling legitimate grounds for the processing that override your interests, rights and freedoms, or
2. that it needs the data for the establishment, exercise or defense of legal claims.

“Compelling” is a higher bar than the ordinary legitimate interest it relied on to begin with. Your job is to explain why the processing affects you specifically. For example: a public listing of your address creates a safety risk because you’ve been harassed; or an old profile harms your job prospects while serving little purpose for the organization.

While the organization considers whether its grounds override yours, you can also ask it to restrict processing, meaning it keeps the data but doesn’t use it, until it decides. If your objection succeeds and there are no overriding grounds, you can ask for erasure too, which our guide to the GDPR right to erasure covers.

Why the right to object matters for your reputation

For reputation problems, objection is often the right that does the work, because much of the content that follows people around online is processed on a legitimate-interest basis rather than consent.

• Directories and profile sites covered by the GDPR often rely on legitimate interests. An objection, backed by your personal circumstances, can lead to a listing being removed.
• Search engines weigh your rights against the public interest when you ask them to delist results for your name. Delisting requests draw on both objection and erasure; our guide to the right to be forgotten explains that process.
• Marketing and data brokers using your data to target you can be told to stop outright.

Objection works less well against journalism, which benefits from freedom of expression protections, and against data an organization is legally required to keep.

How to object, step by step

1. Read the privacy notice. Find the lawful basis for the processing you’re unhappy with, and the contact for the data protection officer or privacy team.
2. Identify the processing. Be specific: marketing emails, a public profile page, profiling for ads, sharing with partners.
3. Explain your situation if the basis is legitimate interests or a public task. Keep it factual and brief. For direct marketing, you don’t need to give a reason.
4. Say what you want. Stop the processing, restrict it while they decide, and erase the data if there are no overriding grounds.
5. Keep a dated copy and note the deadline. Organizations must respond without undue delay and generally within one month, extendable by up to two further months for complex requests if they tell you why.
6. Follow up once if the deadline passes, before escalating.

A template you can adapt

Subject: Objection to processing under Article 21 GDPR

Dear Data Protection Officer,

I object to your processing of my personal data under Article 21 of the GDPR [or the UK GDPR].

My details: [full name, email address, account number or the URL of the page concerned].

The processing I object to: [for example, the public profile at this address, or use of my data for direct marketing and related profiling].

[For legitimate interests or public task:] My reasons, relating to my particular situation, are: [brief factual explanation, for example: this page shows my home address, and I have been harassed at that address].

Please stop this processing and restrict it while you consider my objection. If you have no compelling legitimate grounds that override my interests, rights and freedoms, please erase the data and confirm that you have done so. If you decide to continue, please explain the grounds you rely on.

Please respond within one month of receiving this request.

Yours sincerely,

[Name]

For a pure direct marketing objection, you can shorten this to a single line: “I object to the processing of my personal data for direct marketing, including profiling, under Article 21(2) GDPR. Please stop immediately and confirm.”

A worked example

This is an illustrative scenario, not a real client. Jonas, a teacher in Hamburg, finds that a business directory based in the EU lists him as the owner of a small tutoring company he closed years ago, with his home address, which was once the registered address. Parents searching his name land on the listing and ask whether he still takes students.

• He reads the directory’s privacy notice. It relies on legitimate interests to publish business data.
• He sends an objection explaining that the business no longer exists, that the address is now his private home, and that the listing causes confusion and privacy risk while serving no current purpose. He asks for restriction and then erasure.
• The directory replies within the month. It agrees there’s no overriding reason to keep his home address and the closed business listing, and removes both.
• The search result lingers, so he asks the search engine to refresh the outdated result now that the source page has changed.

Not every objection goes this smoothly. If the directory had refused, Jonas could have complained to his data protection authority.

If your objection is refused or ignored

1. Check the reasons. Has the organization actually shown compelling grounds, or just restated its ordinary interest? Is it using a basis you can’t object to, such as a legal obligation?
2. Reply once, briefly explaining why you think its grounds don’t override yours.
3. Complain to a data protection authority. Our guide on making a GDPR complaint explains how to choose the authority and what to include. In the UK, that’s the ICO.
4. Consider legal advice if the processing is causing serious harm or you want to go to court.

Common mistakes

• Objecting to processing based on consent or contract. For consent, withdraw it instead. For contract, objection generally doesn’t apply.
• Giving no reasons for a legitimate-interest objection. The law asks for grounds relating to your particular situation. Say what they are.
• Assuming a marketing objection means full deletion. A suppression record is usually allowed so they don’t contact you again.
• Expecting objection to remove journalism. Freedom of expression protections usually apply.
• Using the GDPR where it doesn’t apply. It covers organizations in the EU or EEA and those targeting or monitoring people there. In Singapore, the PDPA works through consent withdrawal instead, as our PDPA guide explains.

When to get help

A clear written objection is something most people can send themselves. Help is worth considering when the same data appears on many sites, or when an objection is one part of a wider effort to clean up search results for your name. Our content removal service works on data protection, delisting and platform routes, and we’ll tell you honestly which are likely to succeed.

Frequently asked questions

What is the right to object under the GDPR?

It’s the right in Article 21 to object to an organization processing your personal data. For direct marketing the objection is absolute. For processing based on legitimate interests or a public task, the organization must stop unless it shows compelling legitimate grounds or needs the data for legal claims.

Do I have to give a reason to object to direct marketing?

No. An objection to direct marketing, including related profiling, doesn’t need a reason and the organization must stop processing your data for that purpose.

How long does an organization have to respond to an objection?

Generally one month from receiving it, without undue delay. It can extend by up to two further months for complex or numerous requests, but must tell you within the first month and explain why.

What's the difference between the right to object and the right to erasure?

Objection asks an organization to stop using your data in a particular way. Erasure asks it to delete the data. They often work together: a successful objection with no overriding grounds is itself a ground for erasure.