Table of Contents
Article 21 of GDPR: Right to object to data processing
Article 21 of GDPR provides for an individual’s right to object to the processing of his or her personal information by a company.
Right to object to personal data processing (Article 21(1) GDPR)
If a person had consented that a company collect, process and store their personal data, the person is given the right to object to the further processing of the personal data.
The right to object also applies to instances when a company performs profiling activities with personal data.
When a person objects to the processing of personal data, the company should no longer process the data.
In some limited cases, the company may continue processing the data to the extent:
- it can demonstrate that it has a legitimate ground overriding the person’s interests, rights and freedoms
- It is required for the establishment, exercise or defence of legal claims.
Right to object to data processing for direct marketing purposes (Article 21(2) GDPR)
If a company is processing personal data for direct marketing purposes, a person can request, at any time, that the company stop processing his or her personal data.
Similarly, if a company uses personal data for profiling purposes related to direct marketing, a person can object to such processing at any time.
Cessation of personal data processing (Article 21(3) GDPR)
When a person exercises his or her objection right to prevent the company from processing their personal data for direct marketing purposes or for profiling purposes in relation to direct marketing, the company must immediately cease processing the person’s data.
Notification of right to objection (Article 21(4) GDPR)
Companies must ensure that they provide notification to individuals that they have the right to object to the processing of their personal data at their first communication with the individual.
Objection using automated means (Article 21(5) GDPR)
In the context of the use of information society services, a person can exercise their right to object using automated means.
Objection for other purposes (Article 21(6) GDPR)
When someone’s personal data is processed for scientific, historical research or statistical purposes, a person can still object to the processing of their personal data unless the processing is necessary for the task carried out for reasons of public interest.
Recitals applicable to Article 21 of GDPR
Relevant Recitals: 69, 70
GDPR Regulation article-by-article overview
Read our comprehensive overview of the GDPR Regulation, article by article, where we summarize each of the 99 articles contained in GDPR to give you a complete understanding of its content.
Cited Legislation in Article 21 or relevant recitals
GDPR Text: Article 21 of GDPR and Relevant Recitals
GDPR Text Source: EUR-Lex
Official GDPR Text: General Data Protection Regulation
Official GDPR Title: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), corrected by Corrigendum, OJL 127, 23.5.2018, p. 2 ((EU) 2016/679)
