Information for businesses about the General Data Protection Regulation (GDPR)

Right to Object

What is the right to object under GDPR?

Data subjects can object to the processing of their data (art 21 GDPR) where the purpose is:

  • direct marketing
  • on grounds of legitimate or public interests
  • scientific or historical research and statistics

How do data controllers need to comply with the right to object?

If the purpose is direct marketing (including profiling), data processing must cease immediately. There are no grounds to refuse such an objection.

If the purpose relates to legitimate interests the controller can refuse to comply if they can demonstrate that:

  • “its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject”
  • processing the data “necessary for the establishment, exercise or defence of legal claims”

If the purpose is research, the data subject must demonstrate “grounds relating to his or her particular situation” in order to exercise their right to object.

How can we help you comply with the GDPR?

We provide a GDPR Audit to help businesses understand their data protection obligations under the GDPR and check their compliance with the rules.

Top