Source: OJ L 119, 4.5.2016, pp. 1–88 · Consolidated textCurrent language: EN
- General data protection
Basic legislative acts
- GDPR regulation
Article 21 Right to object
Summary What does Article 21 of the GDPR regulation say?
This article establishes the data subject's right to object to the processing of their personal data.
It covers two distinct scenarios: a general right to object to processing based on public interest or legitimate interests grounds (as defined in Article 6(1)), and a stronger, near-absolute right to object to processing for direct marketing purposes.
In the general case, the controller can override the objection if it demonstrates compelling legitimate grounds; in the direct marketing case, no such override exists — objection means processing must stop.
The article also extends the right to object to scientific, historical research, and statistical processing, though with a public interest exception.
Important points:
- Data subjects can object to processing based on public interest or legitimate interest grounds, but controllers may continue processing if they can demonstrate compelling legitimate grounds that override the data subject's interests.
- Objection to direct marketing processing is absolute — once a data subject objects, processing for that purpose must cease without exception.
- Controllers are required to explicitly bring the right to object to the data subject's attention at the latest at the time of first communication, presented clearly and separately from any other information.
Springlex's summary of the article is a reading aid, not a substitute for the legal text.
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Relevant recitals
Recital 59 Facilitating exercise of data rights
Modalities should be provided for facilitating the exercise of the data subject's rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object. The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means. The controller should be obliged to respond to requests from the data subject without undue delay and at the latest within one month and to give reasons where the controller does not intend to comply with any such requests.
Recital 69 Right to object: legitimate/public interest
Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.
Recital 70 Right to object to marketing
Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.
Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.
Definition
processing
Definition
controller
Definition
processor
Definition
information society service
Definition
profiling
Definition
third party
Definition
personal data