The Right to Object: Stopping Certain Uses of Your Data

What the right to object actually does

The right to object is one of the rights the UK GDPR gives every individual. In plain terms, it lets you tell an organisation to stop using your personal data for a particular purpose — rather than to see it or to delete it. It is about how your data is used going forward.

It is set out in Article 21 of the UK GDPR. The right does not apply to every use of your data in the same way: how strong it is depends on why the organisation is using your data in the first place. The clearest case is direct marketing, where the right is absolute — once you object, the organisation must stop using your data for that purpose, with no balancing test and no exceptions.

For some other uses — for example where an organisation relies on its own legitimate interests, including certain profiling — you can still object, but the organisation may continue if it can show a compelling legitimate reason that overrides your interests, or if it needs the data to establish, exercise or defend a legal claim. This is general information, not legal advice.

Marketing and profiling: the two people search for most

Most people who look up the right to object are trying to do one of two things: stop marketing, or stop being profiled. The right covers both, but they work a little differently.

Direct marketing is the strongest case. If an organisation is sending you marketing — by email, post, phone or otherwise — you can object at any time, and it must stop. This includes profiling that is carried out to support that marketing. You do not have to give a reason, and the organisation cannot ask you to justify your choice.

Profiling outside marketing is more nuanced. Profiling means using your data to analyse or predict things about you — your interests, behaviour or likely choices. Where this is done under legitimate interests rather than for marketing, you can object, and the organisation has to weigh your objection against its own reasons. You stay in control of raising the objection; whether it must stop depends on the purpose and the circumstances.

• For direct marketing, your objection is absolute — the organisation must stop, no balancing test.
• Profiling that supports direct marketing is covered by that same absolute right.
• For other legitimate-interests uses, the organisation must stop unless it shows a compelling overriding reason.
• You never have to explain or justify an objection to direct marketing.
• Objecting stops a particular use; it does not, by itself, delete the data the organisation already holds.

How to object, and what to expect

You can object in writing — a short, clear message is enough. State that you are objecting under the right to object in the UK GDPR, name the use you want stopped (for example, direct marketing or a specific kind of profiling), and send it to the organisation's privacy contact. Keep a dated copy for your own records.

An organisation must make it easy to object to direct marketing and should tell you about this right at the latest when it first contacts you. Where the right is not absolute, the organisation considers your objection and either stops or explains its overriding reason. In practice, objecting is often paired with other rights: you might first ask to see what is held, then object to a specific use of it.

Throughout, the decision is yours: which use to object to, and whether to object at all. OSINTA can help you understand your own footprint and frame and route your own request, but the choice stays with you. If you are unhappy with how an organisation handles your objection, you have the right to complain to the Information Commissioner's Office (ICO). This is general information, not legal advice.

Frequently asked questions

Related terms

• GDPR (General Data Protection Regulation)
• Personal data
• Consent
• Data controller