The right to object depends on the organisation’s purpose and lawful grounds for processing. Generally, you can only object if your data is being used for:
direct marketing purposes
scientific or historical research
tasks carried out that are in the public interest
the exercise of official authority
the organisation’s legitimate interest
See the Information Commissioner's Office (ICO) guidance for more information.
Objecting for direct marketing purposes
The right to object to the use of your personal data for direct marketing purposes is absolute. This means that if you object to the use of your data, the organisation cannot refuse your objection and must stop using your data for direct marketing purposes (eg they can’t continue using your data to sell or promote things to you).
However, if you object to the use of your data for direct marketing, this doesn’t automatically mean that the organisation needs to erase your data. Often, organisations will place you on their ‘suppression list’. This is a list of people who have objected to their data being used for direct marketing purposes. This allows organisations to check against any new direct marketing lists that they may buy at a later date, to ensure that they don’t use your data for direct marketing after you have objected to it.
Objecting for other purposes
The right to object to the use of your personal data for purposes other than direct marketing is generally more restricted. Usually, an organisation can continue to process your personal data despite your objections if:
the processing is necessary for the performance of a task carried out for reasons of public interest, in the case of data processing for the purposes of statistics or scientific or historical research
they can prove that they have compelling legitimate grounds that override your interests, rights and freedoms, in the case of data processing based on legitimate interests, on the performance of a task in the public interest or the exercise of official authority
If you object to the use of your data for purposes other than direct marketing, the data controller (ie the person who says how and why personal data is processed) will need to carry out a balancing exercise to determine whether they will be able to continue processing your personal data.