Term
Right to object
A data subject's GDPR right to object to processing based on legitimate or public interests. For direct marketing the controller must always stop; in other cases unless it shows compelling legitimate grounds.
Updated
What it means
The right to object is a data subject's right under the GDPR to object to processing of their personal data carried out on the basis of legitimate interest or public interest. It does not apply to processing based on consent, contract or legal obligation.
For direct marketing the right is absolute: if the person objects, the controller must stop that processing whatever its reasons. This also covers profiling linked to direct marketing. In other cases processing may continue only if the controller shows compelling legitimate grounds that override the person's interests.
The controller must explicitly draw attention to the right to object at the latest in the first communication, clearly and separately from other information. For a newsletter or sales emails, that in practice means a visible unsubscribe link in every message.
How it works in practice
An objection can arrive in any form and needs no justification where marketing is concerned. The company must make sure the contact lands on a suppression list in every tool, rather than reappearing later from another import.
For other processing based on legitimate interest, such as CCTV or internal analytics, the controller assesses the person's specific circumstances. If it cannot show overriding grounds, processing stops; during the assessment the person can request restriction of processing.
The outcome must normally be communicated within one month and documented. Good practice is to keep a log of objections with date, decision and reasoning, useful both in an inspection and for repeat requests.
What to watch out for
Continuing to send marketing after an unsubscribe is one of the most common causes of complaints and fines. A technical glitch or a forgotten list in another tool is no excuse; the controller is responsible for keeping systems in sync.
An objection covers only the specific processing. If a person objects to marketing, the company can still process their data to perform a contract and meet legal duties such as invoicing, and need not delete them.
Need the term explained on your own situation? Consulting from €55 / hour excl. VAT, depending on topic and complexity.