Objecting to the use of personal data

You have the right to object to organisations processing your personal data (eg name or address) at any time. Processing personal data refers to any use of personal data (other than for personal reasons) and includes obtaining, recording and storing the data. This means that you can stop or prevent an organisation from using your data. However, the right to object only applies in specific circumstances and organisations may not be required to stop processing your data if they have strong and legitimate reasons.

An objection may be made in relation to all of the personal data an organisation holds about you or only certain pieces of information.

The right to object depends on the organisation’s purpose and lawful grounds for processing. Generally, you can only object if your data is being used for:

• direct marketing purposes

• statistical purposes

• scientific or historical research

• tasks carried out that are in the public interest

• the exercise of official authority

• the organisation’s legitimate interest

See the Information Commissioner's Office (ICO) guidance for more information.

Objecting for direct marketing purposes

The right to object to the use of your personal data for direct marketing purposes is absolute. This means that if you object to the use of your data, the organisation cannot refuse your objection and must stop using your data for direct marketing purposes (eg they can’t continue using your data to sell or promote things to you).

However, if you object to the use of your data for direct marketing, this doesn’t automatically mean that the organisation needs to erase your data. Often, organisations will place you on their ‘suppression list’. This is a list of people who have objected to their data being used for direct marketing purposes. This allows organisations to check against any new direct marketing lists that they may buy at a later date, to ensure that they don’t use your data for direct marketing after you have objected to it.

Objecting for other purposes

The right to object to the use of your personal data for purposes other than direct marketing is generally more restricted. Usually, an organisation can continue to process your personal data despite your objections if:

• the processing is necessary for the performance of a task carried out for reasons of public interest, in the case of data processing for the purposes of statistics or scientific or historical research

• they can prove that they have compelling legitimate grounds that override your interests, rights and freedoms, in the case of data processing based on legitimate interests, on the performance of a task in the public interest or the exercise of official authority

If you object to the use of your data for purposes other than direct marketing, the data controller (ie the person who says how and why personal data is processed) will need to carry out a balancing exercise to determine whether they will be able to continue processing your personal data.

If you have the right to object to the processing of your data, you should directly contact the organisation, explaining why you believe they should stop using your data. 

Objections can be made verbally or in writing; however, it is recommended that they are made in writing in order to have a written record. If you make a verbal request, you should follow up in writing explaining your concern, giving evidence and stating your desired solution.

Consider using the ICO’s template to make an objection.

When organisations receive an objection to the processing of personal data, they will need to determine whether they are required to comply with the objection. If they receive an objection to the processing of data for direct marketing they will need to stop. 

If an objection is successful, the organisation must stop (or not begin) processing your personal data for that purpose. They may, however, be able to continue processing your data for other purposes.

Depending on the circumstances, stopping the processing of personal data may result in the organisation having to delete your personal data. However, this may not always be the appropriate action to take (eg for direct marketing purposes it may be appropriate to store the data in a suppression list).

Organisations cannot refuse to comply with an objection for direct marketing purposes. However, organisations can refuse to comply with your objection if: 

• they have a strong reason to continue processing your data that overrides your objection  (for data uses other than for direct marketing)

• an exemption applies

• they believe that it is ‘manifestly unfounded or excessive’ (eg the request was made to harass or disrupt the organisation)

If the latter applies, organisations can request a reasonable fee or even refuse to deal with the objection. 

You should be informed of the result of your objection, regardless of the outcome. If the organisation decides that it does not need to stop processing your data, it should explain its reasoning.

Generally, organisations have one month to respond to your objection. However, in certain circumstances, they may need extra time to handle your request and can take up to two months. For example, because you have made several requests or they require proof of ID before handling the request. If an organisation needs an extension, they need to let you know and provide an explanation within one month.

For more information, read Data protection requests.

Can organisations charge a fee?

Generally, data requests should be dealt with and provided free of charge. However, an organisation may be able to charge a fee in certain, limited circumstances, including where the organisation finds the request to be manifestly unfounded or excessive. For more information, read Data protection requests.

If an organisation doesn’t respond to your objection or you are dissatisfied with their response, you should contact the organisation. If, after contacting the organisation, you do not receive a response or remain dissatisfied, you can complain directly to the ICO. You may also be able to seek enforcement through the courts. For more information, read Data protection requests.