Article 21 of GDPR: Right to object
Article 21 of the GDPR Explained
The right to object applies in two main cases:
- When the processing is based on the legitimate interest of the data controller or on the performance of a task carried out in the public interest;
- When the processing is carried out for direct marketing purposes (direct marketing).
In the first case, the controller may refuse the objection if they demonstrate the existence of compelling legitimate grounds. In the second case (marketing), the objection is absolute and cannot be refused.
Why This Article Matters for Your GDPR Compliance
The right to object is central to respecting the wishes of individuals. It is frequently used in the context of direct marketing. Failure to comply with it constitutes an infringement which may be subject to sanctions from the French supervisory authority.
Application Examples of Article 21 of the GDPR
- A user clicks 'unsubscribe' from a newsletter: their email is immediately removed from campaigns.
- A citizen objects to the use of their data for statistics: the public body must verify if there is a compelling legitimate ground for continued processing.
- An employee objects to the use of their data for non-essential HR behavioural analysis purposes.
Related Resources
Accelerate your compliance in a few clicks
With our all-in-one solution, you can easily accelerate and ensure your compliance:
- Automate your compliance with our GDPR software
- Supported or outsourced by our DPO experts
- Raise awareness among your teams with our GDPR e-learning training
Assess your situation in 15 minutes with our GDPR self-assessment, free and without obligation.
How to comply with Article 21 of the GDPR?