GDPR Article 21 lets people challenge certain uses of their personal data. The outcome depends on the purpose and legal basis. An objection to direct marketing ends processing for that purpose, including related profiling. An objection to processing based on legitimate interests or a public task requires a different assessment, connected to the person’s particular situation. Research has a further specific rule.
For an organisation, the practical difficulty is usually identifying which operations must change. A customer record may support advertising, deliveries, accounting and fraud prevention at the same time. An objection does not make those purposes interchangeable, and deleting the whole record may fail to stop future marketing. This guide explains how to classify the request, make a defensible decision and carry it through the relevant systems. The legal text was checked on 28 September 2026.
The three routes under Article 21
Under Article 21 of the GDPR, paragraph 1 concerns processing based on Article 6(1)(e) or (f): public interest or official authority tasks, and legitimate interests. The person objects on grounds relating to their particular situation. The controller must stop unless it demonstrates compelling legitimate grounds overriding the person’s interests, rights and freedoms, or processing is needed for establishing, exercising or defending legal claims.
Paragraphs 2 and 3 concern direct marketing. The person can object at any time, without explaining a particular vulnerability or proving that the advertising causes harm. Once the objection applies, the data must no longer be processed for those marketing purposes. Commercial convenience, the cost of acquiring the contact and an attractive offer do not provide a balancing defence.
Paragraph 6 covers processing for scientific or historical research or statistical purposes under Article 89(1). The person can object on grounds relating to their particular situation, unless the processing is necessary for performing a task carried out for reasons of public interest. A research label alone does not establish that exception. The purpose, necessity and applicable safeguards must be examined.
These routes concern particular processing operations. They are not a general power to override every legal obligation to keep information. A request may nevertheless raise additional rights, such as erasure or restriction. Staff should recognise the substance of the request rather than insist that the person selects the correct article from a menu.
First identify the purpose and legal basis
Start with the activity challenged: promotional calls, behavioural profiling, public-service analysis, fraud screening or a research project, for example. Then identify the controller and the actual basis for that activity. A privacy notice listing every Article 6 basis without connecting them to purposes will not answer this question. The decision needs to reflect what the organisation really does.
The legitimate interest assessment conducted before processing provides relevant context, but it is not the final answer to an individual objection. The initial assessment asks whether processing can be justified generally. Article 21(1) adds the person’s particular situation and requires compelling grounds to continue. Repeating the original conclusion without engaging with that situation misses the point of the right.
Processing necessary for a statutory obligation does not become subject to Article 21(1) merely because the same database also contains marketing records. Equally, calling an optional profiling activity “contract administration” does not make it contractually necessary. Examine each purpose on its own facts. Where the organisation has used an incorrect basis, it must address that problem rather than use the rights procedure to conceal it.
If processing relies on consent, the relevant mechanism may be withdrawal under Article 7(3). Withdrawal does not affect the lawfulness of earlier processing based on consent, but it removes permission for future processing on that basis. The Article 7 consent guide explains that distinction. A person should not have to know whether an unwanted advertisement was sent on consent or legitimate interests before being able to stop it.
Assessing an objection based on a particular situation
The person’s reasons help identify how the processing affects them. They may concern personal safety, inaccurate assumptions, an unusual dependency or consequences that the controller’s general assessment did not capture. Ask only for information needed to understand those reasons. Automatically requiring a passport, medical evidence or an extensive questionnaire can create unnecessary barriers and collect further sensitive information.
The controller bears the burden of demonstrating the grounds for continuing. A reasoned assessment connects a concrete interest or public task to the particular operation, examines its necessity and weighs the person’s circumstances. It should consider whether a less intrusive alternative would achieve the relevant objective. The fact that processing is technically convenient does not establish that it must continue unchanged.
Consider a hypothetical service provider using legitimate interests for fraud detection. A customer objects because a shared address repeatedly links them to another person’s activity. The controller should examine the actual signals, consequences and alternatives. It might stop one correlation, correct an input or restrict a particular use while maintaining justified fraud controls. Neither “fraud prevention always wins” nor “every objection requires deleting all security records” is a sound decision rule.
The legal-claims limb also requires a connection to establishing, exercising or defending claims. A speculative assertion that someone might sue someday is not a licence to continue unrelated profiling indefinitely. Document the information needed, the relevant dispute or reasonably assessed need and the permitted access. The objection decision should explain the continued purpose in language the person can understand.
Restriction while the grounds are being checked
Article 18(1)(d) gives the person a right to restriction where they have objected under Article 21(1), pending verification of whether the controller’s legitimate grounds override theirs. This is an important related request to recognise. It should not be confused with the unconditional end to direct-marketing processing after a marketing objection.
When restriction applies, storage can continue, but other processing is limited to the grounds in Article 18(2): consent, legal claims, protecting another person’s rights, or important public-interest reasons of the Union or a Member State. A restricted record should therefore be marked and excluded from incompatible workflows. Before lifting the restriction, the controller must inform the person under Article 18(3).
The Article 18 restriction guide provides the wider framework. Operationally, the rights team needs a route to apply restrictions in downstream systems, not only a note in a correspondence file. Where technical limitations prevent an immediate granular change, the organisation must determine an effective protective measure rather than assume the assessment period allows normal processing to continue without qualification.
Direct marketing: stop the purpose the person rejected
A direct-marketing objection does not require balancing against revenue or proof of harm. It also covers profiling to the extent that profiling relates to direct marketing. Stopping emails while continuing to score the same person for targeted advertising can therefore leave the relevant objection unimplemented. Examine the audience selection and profiling stages, as well as the final message.
Interpret the request’s scope fairly. “Stop all marketing” ordinarily reaches the controller’s relevant marketing channels; “unsubscribe this address from this newsletter” may be narrower. Do not use ambiguity to continue the clearly rejected activity. If clarification is genuinely needed, stop the unambiguous part and make the clarification proportionate. The specialist guide to Article 21 objections to direct marketing examines that workflow in more detail.
Essential service communications require their own assessment. A notice needed to complete an order is different from a promotional offer, but adding an advertisement to a service message does not make the advertisement necessary. Staff should avoid telling customers they must accept marketing to receive ordinary contractual support. Any continued service processing still needs its own valid basis and appropriate scope.
Article 21 does not itself decide whether an email, text or call was lawful before the objection. The electronic-marketing rules implementing the ePrivacy Directive, particularly Article 13, may impose consent or other conditions for the channel concerned. The opt-in and opt-out guide helps separate those questions. An accessible opt-out cannot retrospectively cure an unlawful collection or message.
Suppression lists and downstream systems
Deleting a contact from the campaign application may allow the same address to return through an imported list. A suppression mechanism instead records enough information to prevent the rejected use from restarting. Its purpose is respecting the objection, not maintaining an alternative advertising database. The organisation must justify the necessary data, access and retention for that compliance function.
Keep the suppression record limited. Depending on the channel, a contact identifier and the scope and date of the objection may suffice. Avoid retaining a complete purchase history or behavioural profile merely because a minimal exclusion record is needed. Access should be limited to the functions that apply or supervise suppression, and the record should not be reused to target another campaign.
This is where an appropriate retention policy matters. There is no universal GDPR rule that all suppression records expire after one fixed number of years. The organisation must consider how long the identifier could otherwise be reintroduced, whether the record remains necessary and how it will handle changed contact details. Retention needs a reason that can be explained, rather than an indefinite default.
Map every route by which marketing resumes: scheduled exports, call-centre files, audience uploads, reseller feeds and recovered backups. Processors acting on the controller’s behalf need instructions and confirmation of implementation. Separately responsible recipients need their own legal analysis; do not assume that all organisations holding the same address are a single controller. Record what was communicated, to whom and for which operations.
A verified enforcement example: TIM
On 15 January 2020, Italy’s Garante adopted a corrective and sanctioning decision concerning TIM. The authority imposed €27,802,946 for multiple violations involving marketing and other processing. Its announcement of 1 February 2020 is a publication date, distinct from the decision date.
The decision describes unsolicited calls, failures to handle objections and inconsistencies between the company’s exclusion lists and those used by partners. The amount is not a tariff for a single missed unsubscribe request, and this account does not establish a later appeal outcome or payment. Its practical relevance is the failure to make a person’s refusal effective across interconnected operations.
For an internal review, follow a single objection from receipt to the next campaign export. Can the organisation show that its own system and the relevant processor used the same current instruction? Does a later import restore the contact? These checks address the operational problem illustrated by the decision without assuming that every organisation has the same facts or exposure.
Response time and communication
Article 12 requires action without undue delay and a response on the action taken within one month of receipt. Where necessary because of complexity and number of requests, the period may be extended by two further months, with notice and reasons within the first month. A calendar month is not a standard thirty-day service target.
The response period is not permission to send marketing until the final day. Article 21(3) requires the relevant marketing processing to cease after the objection. Organisations should therefore separate the operational stop from the completion of the written response. An internal same-day handling target may be useful, but it should not be presented as a statutory twenty-four-hour grace period.
If the controller does not act on a request, Article 12(4) requires it to explain the reasons without delay and at the latest within one month, together with information about the possibility of complaining to a supervisory authority and seeking a judicial remedy. A refusal under Article 21(1) should explain the relevant assessment; simply saying “our legitimate interests prevail” provides little meaningful information.
Requests are generally free. Article 12(5) permits a reasonable fee or refusal for manifestly unfounded or excessive requests under its conditions, with the burden on the controller. Disagreement with the request or inconvenience is not enough. Where reasonable doubts exist about identity, Article 12(6) permits additional information necessary to confirm it. That does not justify routinely requiring formal identification for an ordinary unsubscribe from an identifiable address.
Notice, channels and automated objections
Article 21(4) requires the rights in paragraphs 1 and 2 to be brought explicitly to the person’s attention, at the latest at the first communication, clearly and separately from other information. Burying the right among unrelated contractual provisions undermines that requirement. The notice should help the person understand both the challenged purpose and a usable route to object.
Article 21(5) allows the right to be exercised through automated means using technical specifications in the context of information-society services, without prejudice to the ePrivacy Directive. It should not be restated as a universal GDPR requirement for one particular button design. A straightforward unsubscribe control is a sensible implementation for many marketing services, while valid requests received through other channels still need handling.
A telephone agent, support mailbox or account manager may receive the request before the privacy team does. Train those functions to recognise ordinary language, record receipt and forward the request promptly. Do not reset the clock because the organisation routed it internally. Clear ownership of that handover often matters more than adding another form to the website.
Research and the relationship with other rights
For scientific or historical research and statistical processing under Article 89(1), examine the particular situation and whether the processing is necessary for a public-interest task. A private organisation does not establish that exception merely by calling its analysis research. Conversely, a genuine public-interest necessity must be considered with the relevant legal framework and safeguards, rather than ignored because a request uses the word “delete”.
The right of access can help someone understand the processing they wish to challenge. The right to erasure addresses deletion under its own grounds and exceptions. Article 17 includes successful objections among its grounds, but that does not mean every objection removes records needed for another lawful purpose.
A defensible outcome therefore identifies the activities stopped, any restrictions applied, the records still needed and the reasons for retaining them. It also confirms that downstream actions were completed. That combination gives the person a meaningful answer and gives the organisation evidence that the right changed the processing in practice.