Profile information Account settings
Help Contact us
Sign up Log in
Help Contact us

Objecting to the use of personal data

Under article 21 of the UK General Data Protection Regulations (GDPR), individuals have the right to object to a business or other organisation processing their personal data. Read this guide to find out how you can object to your personal data being used.

You have the right to object to organisations processing your personal data at any time. Processing personal data refers to any use of personal data (other than for personal reasons) and includes obtaining, recording and storing the data. This means that you can stop or prevent an organisation from using your data. However, the right to object only applies in specific circumstances and organisations may not be required to stop processing your data if they have strong and legitimate reasons.

An objection may be made in relation to all of the personal data an organisation holds about you or only certain pieces of information.

The right to object depends on the organisation’s purpose and lawful grounds for processing. Generally, you can only object if your data is being used for:

  • direct marketing purposes

  • statistical purposes or scientific or historical research

  • tasks carried out that are in the public interest

  • the exercise of official authority

  • the organisation’s legitimate interest

See the Information Commissioner's Office (ICO) guidance for more information.

Objecting for direct marketing purposes

The right to object to the use of your personal data for direct marketing purposes is absolute. This means that if you object to the use of your data, the organisation cannot refuse your objection and must stop using your data for direct marketing purposes (eg they can’t continue using your data to sell or promote things to you).

However, if you object to the use of your data for direct marketing, this doesn’t automatically mean that the organisation needs to erase your data. Often, organisations will place you on their ‘suppression list’. This is a list of people who have objected to their data being used for direct marketing purposes. This allows organisations to check against any new direct marketing lists that they may buy, for example, at a later date, to ensure that they don’t use your data for direct marketing after you have objected to it.

Objecting for other purposes

The right to object to the use of your personal data for purposes other than direct marketing is generally more restricted. Usually, an organisation can continue to process your personal data despite your objections if:

  • the processing is necessary for the performance of a task carried out for reasons of public interest, in the case of data processing for the purposes of statistics, scientific or historical research

  • they can prove that they have compelling legitimate grounds that override your interests, rights and freedoms, in the case of data processing based on legitimate interests, on the performance of a task in the public interest or the exercise of official authority

If you object to the use of your data for purposes other than direct marketing, the data controller (ie the person who says how and why personal data is processed) will need to carry out a balancing exercise to determine whether they will be able to continue processing your personal data.

If you have the right to object to the processing of your data, you should directly contact the organisation to let them know, explaining why you believe they should stop using your data. 

Objections can be made verbally or in writing; however, it is recommended that they are made in writing in order to have a written record. If you make a verbal request, you should follow up in writing explaining your concern, giving evidence and stating your desired solution.

Consider using the ICO’s template to make an objection.

When organisations receive an objection to the processing of personal data, they will need to determine whether they are required to comply with the objection. If they receive an objection to the processing of data for direct marketing they will need to stop. 

If an objection is successful, the organisation must stop (or not begin) processing your personal data for that purpose. They may, however, be able to continue processing your data for other purposes.

Depending on the circumstances, stopping the processing of personal data may result in the organisation having to erase your personal data. However, this may not always be the appropriate action to take (eg for direct marketing purposes it may be appropriate to store the data in a suppression list).

Organisations cannot refuse to comply with an objection for direct marketing purposes. However, organisations can refuse to comply with your objection if: 

  • they have a strong reason to continue processing your data that overrides your objection  (for data uses other than for direct marketing)

  • an exemption applies

  • they believe that it is ‘manifestly unfounded or excessive’ (eg the request was made to harass or disrupt the organisation)

If the latter applies, organisations can request a reasonable fee or even refuse to deal with the objection. 

You should be informed of the result of your objection, regardless of outcome. If the organisation decides that it does not need to stop processing your data, they should explain their reasoning.

Organisations generally have one month to respond to your request. In some circumstances (eg if you have made several requests or where proof of ID is required), organisations may need extra time to consider your request and can take up to an extra two months to respond. Organisations should inform you within one month if they need more time and explain why. 

While data requests should generally be dealt with and provided free of charge, an organisation may be able to charge a fee in certain, limited circumstances (eg where the organisation finds the request to be manifestly unfounded or excessive).

For more information, read Data protection requests.

If an organisation doesn’t respond to your request or you are dissatisfied with their response, you should contact the organisation. If you do not receive a response or remain dissatisfied with the response, you can complain to the ICO. You can also consider seeking enforcement through the courts. For more information, read Data protection requests.

We use cookies to provide the best experience