Objections to processing

There are two circumstances where the right to object to processing can be exercised:

  1. An absolute right to object to processing for the purposes of direct marketing (Articles 21(2) & (3) of the Applied GDPR)
  2. A qualified general right in specified circumstances (Articles 21(1) & (6) of the Applied GDPR)

1. Absolute right to object to processing for direct marketing purposes

This right applies to ANY form of marketing and also applies to profiling of individuals undertaken in respect of direct marketing activities. Controllers should note that whilst there continue to be additional specific rules relating to electronic direct marketing (the Unsolicited Communications Regulations 2005), these are not covered on this page.

The right must be explicitly brought to the attention of individuals clearly and separately from any other information at the latest at the time of the first communication.

2. Qualified general right in specified circumstances

Individuals have the right to object to all, or particular, elements of processing, such as disclosures to certain parties, including for profiling purposes, where the processing is necessary for one of two specific grounds:

In the case of public interest tasks etc., these are discretionary exercises of official authority, or implied powers, and is of particular relevance to the public sector.

The legitimate interest ground for processing only applies in the private sector. 

In either case, controllers must make a specific consideration of the processing of that individual’s personal data in the context of their particular circumstances.  It cannot be a generalised deliberation. 

The controller cannot process the relevant personal data until it has demonstrated “compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims”.  

Restrictions on the right

The right to object to processing can be restricted where "such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society". The controller must be able to demonstrate that any restriction imposed is necessary in the circumstances.

The restrictions and exemptions are set out in Schedule 9 of the Implementing Regulations.  

Non-compliance with requests to exercise rights

If the controller is not taking action on the request of the individual to exercise any right, it must inform the individual “without delay” (and within ONE month of receipt of the request) about: