GDPR right to object

Definition: Article 21 of the General Data Protection Regulation (GDPR) gives people a right to object to specified uses of their personal data. The conditions depend on the processing's legal basis and purpose, with a separate rule requiring direct marketing to stop following an objection.

Key facts

• GDPR Article 21(1) covers objections based on a person's particular situation when processing relies on public-interest tasks, official authority or legitimate interests.
• The European Data Protection Board's small business guide explains that a person objecting to direct marketing needs to provide no reasons; processing for that purpose must end.
• CNIL's guidance on exercising rights, published on 5 January 2026, addresses rights over training datasets and AI models that are not considered anonymous.

Which processing can a person object to?

Personal data means information relating to an identified or identifiable individual. Processing includes collecting, storing and using that information. A controller is the person or organisation that determines the purposes and means of processing.

Under Articles 6 and 21 of the GDPR, the situation-based right applies to processing necessary for a public-interest task or the exercise of official authority, and processing based on legitimate interests. Legitimate interests are interests pursued by the controller or a third party, subject to balancing against the individual's rights and interests. Article 21(1) also covers profiling based on these grounds: automated evaluation of personal aspects, such as interests or behaviour.

The person must give grounds relating to their particular situation. The controller must stop processing unless it demonstrates compelling legitimate grounds that override the person's interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims.

For direct marketing, Article 21(3) requires that personal data no longer be processed for those purposes after the person objects.

Related profiling falls within the marketing objection. For scientific or historical research and statistics under Article 89(1), Article 21(6) provides a situation-based right, except where processing is necessary for a task carried out for reasons of public interest.

How must a controller handle an objection?

Article 21(4) of the GDPR requires the controller to highlight the right clearly and separately from other information, at the latest in its first communication with the individual.

Article 12 requires information about action taken without undue delay and within one month of receipt. Complexity or the number of requests can justify an extension of two further months, with reasons communicated within the initial month. A refusal requires reasons and information about complaints to a supervisory authority and judicial remedies.

Article 18(1)(d) gives the person a right to obtain restriction while the controller verifies whether its legitimate grounds override theirs. Restriction limits further use of stored data; Article 18(2) specifies permitted processing, including storage and processing for legal claims.

What changes for personal data used in AI systems?

CNIL's AI rights guidance recommends explaining whether a request concerns training data or the model, and how the controller responds. This matters when a dataset change has no immediate effect on an already developed model.

For web collection, CNIL encourages technical solutions that respect objections before collection, including suitable rejection lists. It also distinguishes a model from a system that adds information through web search or a knowledge base. Identifying the component supplying the personal data helps identify the controller to approach.

Related terms

• GDPR lawful basis for web data
• GDPR transparency for web collection
• GDPR right to erasure
• GDPR right to rectification

FAQ

Can I object if processing relies on my consent?

Article 7(3) of the GDPR gives you the right to withdraw consent at any time. Withdrawal leaves the lawfulness of processing before withdrawal unaffected.

Does an objection require my data to be erased?

Article 17(1)(c) provides for erasure following an Article 21(1) objection where no overriding legitimate grounds remain, or following a direct-marketing objection. Article 17(3) sets exceptions, including where processing is necessary for freedom of expression and information or legal claims.

Can I be charged for submitting an objection?

Article 12 provides for rights requests to be handled free of charge. For manifestly unfounded or excessive requests, the controller can charge a reasonable fee or refuse to act, and bears the burden of demonstrating those circumstances.

Sources

1. European Parliament and Council, "Regulation (EU) 2016/679 (General Data Protection Regulation)", 27 April 2016
2. European Data Protection Board, "Respect individuals’ rights", undated
3. CNIL, "Ensuring and facilitating the exercise of data subjects’ rights", 5 January 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer