What is the GDPR right to object (Article 21)?

The right to object is the GDPR right that turns a lawful basis into a live question. If you process personal data because it is in your legitimate interests, a person can push back and ask you to stop, and for direct marketing they can stop you outright. Article 21 sets out when the objection is absolute, when it is qualified, and what you have to tell people before they ever exercise it.

When does the right to object apply?

Article 21(1) gives a data subject the right to object, on grounds relating to their particular situation, at any time to processing based on point (e) or (f) of Article 6(1), which is a public task or legitimate interests, including profiling based on those grounds. The right does not attach to every lawful basis. Processing you carry out under a contract or a legal obligation is not open to objection in the same way, which is why identifying your basis for each activity is the first step. Get the basis map right and you know exactly where an objection can land.

The absolute right: direct marketing

Article 21(2) is the part with no wiggle room. A person has the right to object at any time to processing of their personal data for direct marketing, which includes profiling to the extent it is related to that marketing. Article 21(3) then states that once they object, the data shall no longer be processed for those purposes. There is no balancing test and no compelling-grounds exception here. In practice you do not always have to erase the record; suppressing their details so they are never marketed to again is usually the cleaner way to honour the objection.

The qualified right: legitimate interests and public task

Where the objection is to legitimate-interests or public-task processing, Article 21(1) lets you keep going only in narrow circumstances. You must demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the person, or show that you need the data for the establishment, exercise or defence of legal claims. The burden sits with you, the controller, and a weak business preference will not clear it. If the person objects because the processing causes them real damage or distress, their side of the balance carries more weight.

What you must tell people, and how fast

Article 21(4) requires that the right to object be explicitly brought to the person's attention at the latest at the time of your first communication with them, and be presented clearly and separately from any other information, not buried in a privacy notice. Under Article 12(3) you respond without undue delay and within one month, extendable by two further months for complex requests if you tell the person within the first month. Article 21(5) adds that for online services people may object by automated means, so build the mechanism rather than relying on email. Keep the privacy notice and your records aligned so an objection is easy to action.

Next step

The right to object is where a legitimate-interests basis gets tested, and refusing an objection you should have honoured is the kind of mistake regulators notice. The free 2-minute Obligation Scan flags where the GDPR applies to you and which data-subject rights, including objection and erasure, you need a process for. The GDPR compliance hub sets the duties in order.