What is the GDPR right to object under Article 21?
Article 21 gives the data subject the right to object, on grounds relating to his or her particular situation, at any time to processing based on point (e) or (f) of Article 6(1), including profiling based on those provisions, and a separate right to object at any time to processing for direct marketing purposes, including related profiling. Recital 69: even lawful public-task or legitimate-interest processing can still be objected to; the controller must show a compelling legitimate interest that overrides. Recital 70: the marketing objection covers initial or further processing, at any time and free of charge, and must be presented clearly and separately. See also Legitimate Interest Under GDPR and The EU GDPR Explained.
When is the GDPR right to object to direct marketing absolute?
Where personal data are processed for direct marketing purposes, Article 21(2) gives the right to object at any time, including to profiling related to that marketing, and Article 21(3) states that the personal data shall no longer be processed for such purposes. EDPB Guidelines 1/2024 paragraph 122 call that objection unconditional and irrespective of the legal basis. No reasons are required, and the controller cannot keep marketing by showing compelling legitimate grounds. Recital 47 still allows legitimate interest as a possible basis for marketing; Article 21(2)–(3) is the later stop. Article 21(4) and Recital 70 require the right to be presented clearly and separately, at the latest at the first communication.
When is the GDPR right to object only qualified?
Under Article 21(1), the controller shall no longer process the personal data unless it demonstrates compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims. Article 21(1) does not cover consent, contract, legal obligation or vital interests in Article 6(1)(a)–(d). EDPB Guidelines 1/2024 paragraph 71: sparse detail about the “particular situation” is not by itself enough to dismiss the objection. Paragraphs 72–73: the burden is on the controller, and “compelling legitimate grounds” is a higher threshold than re-running the original Article 6(1)(f) test. Article 21(6) is a narrower research/statistics objection under Article 89(1), unless the processing is necessary for a public-interest task. Legal or similarly significant automated decisions are a separate lock in Article 22.
Which Article 21 paragraph applies in everyday cases?
Match the lawful basis and the purpose first: marketing uses Article 21(2)–(3); public-task or legitimate-interest processing uses Article 21(1) plus, while the controller checks overriding grounds, restriction under Article 18(1)(d); consent uses Article 7(3) withdrawal rather than Article 21(1).
| Situation | Which rule? | Can processing continue? |
|---|---|---|
| Email or postal advertising, or profiling for that advertising | Article 21(2)–(3); Recital 70 | No, not for those marketing purposes. No compelling-grounds defence (EDPB Guidelines 1/2024 paragraph 122). |
| Legitimate-interest analytics or public-task processing, not marketing | Article 21(1); Recital 69 | Only if the controller demonstrates compelling legitimate grounds that override, or legal-claims grounds. Re-using the original LIA is not enough (EDPB paragraph 73). |
| Same Article 21(1) objection, while the controller is still checking | Article 18(1)(d) | Restriction: with the exception of storage, processing only with consent, for legal claims, to protect another person, or for important public interest (Article 18(2)). |
| Processing based on consent (Article 6(1)(a)), not as marketing | Article 7(3) withdrawal; Article 21(1) does not apply | Withdrawal does not affect lawfulness before withdrawal. Marketing on any basis still faces Article 21(2). |
| Scientific or historical research or statistics under Article 89(1) | Article 21(6) | The person may object on grounds relating to his or her particular situation unless the processing is necessary for a public-interest task. |
Does objecting mean the controller must erase the data?
Article 21(3) stops processing for direct marketing purposes; Article 17(1)(c) is the separate erasure ground where the person objects pursuant to Article 21(1) and there are no overriding legitimate grounds, or objects pursuant to Article 21(2), unless an Article 17(3) exception applies. EDPB Guidelines 1/2024 paragraph 78: as a rule, a granted Article 21(1) objection should also support related erasure under Article 17(1)(c). Paragraph 77: the controller cannot refuse merely because the person did not label the request. The Article 17(3) exceptions are in GDPR Article 17: Right to Erasure Explained. There is no general “suppression list always wins” rule in those articles.
How must a controller handle a GDPR right to object request?
Article 12(2) requires the controller to facilitate rights under Articles 15 to 22; Article 21(4) requires those objection rights to be presented clearly and separately at the latest at the first communication; Article 12(3) sets a one-month information deadline, extendable by two further months with reasons; Article 12(5) makes the action free of charge unless the request is manifestly unfounded or excessive. Article 13(2)(b) already lists the right to object when data are collected from the person (Article 13 vs Article 14). Article 21(5) allows objection by automated means using technical specifications in information-society services, notwithstanding Directive 2002/58/EC. Article 83(5)(b) puts infringements of Articles 12 to 22 at up to EUR 20,000,000 or 4% of worldwide annual turnover of the preceding financial year, whichever is higher. The same one-month clock is in How to Handle a GDPR Subject Access Request.
How was this guide checked?
GDPR Exam Trainer mapped each legal sentence to the English EUR-Lex text of Articles 6(1), 7(3), 12, 13(2)(b), 17(1)(c), 17(3), 18(1)(d), 18(2), 21 and 83(5)(b) and Recitals 69–70, and to EDPB Guidelines 1/2024 (version 1.0 for public consultation, adopted 8 October 2024) paragraphs 71–73, 77–78 and 122. The responsible organisation is GDPR Exam Trainer. The method is source mapping plus an independent citation gate, for DPO candidates — not legal advice. Practitioner pages below are qualitative signals of recurring questions, not legal sources.
Frequently asked questions
These answers apply Article 21, Recitals 69–70, Article 12 and EDPB Guidelines 1/2024 to the questions candidates actually ask about unsubscribe clicks, cookie-banner legitimate interest and “delete everything”.
Does the GDPR right to object apply if processing is based on consent or a contract?
Article 21(1) applies only to processing based on Article 6(1)(e) or (f), including profiling based on those provisions. Consent is withdrawn under Article 7(3), not under Article 21(1). Direct marketing is different: EDPB Guidelines 1/2024 paragraph 122 state that the Article 21(2) marketing objection is unconditional and irrespective of the legal basis relied on by the controller.
Is the GDPR right to object to direct marketing absolute?
Yes. Article 21(2) gives the right to object at any time to processing for direct marketing, including related profiling. Article 21(3) then says the personal data shall no longer be processed for such purposes. Recital 70 adds that this is free of charge. The controller cannot keep marketing by showing compelling legitimate grounds.
Does an unsubscribe request count as an Article 21(2) objection?
The Regulation does not require a particular form. Article 12(2) requires the controller to facilitate the exercise of rights under Articles 15 to 22. EDPB Guidelines 1/2024 paragraph 122 say it is enough that the data subject puts forth an objection, and that the controller should allow the person to object at any time in an easy way and free of charge. A clear unsubscribe or “stop marketing” message is such an objection.
Must a controller erase all data after a marketing objection?
Article 21(3) stops processing for direct marketing purposes. It does not, by itself, describe every other purpose. A separate erasure ground sits in Article 17(1)(c) where the person objects pursuant to Article 21(2), subject to the Article 17(3) exceptions. Do not treat “stop marketing” and “erase the customer record” as the same request without checking Article 17.
How long does a controller have to respond to an objection?
Article 12(3) requires the controller to provide information on action taken on a request under Articles 15 to 22 without undue delay and in any event within one month of receipt, extendable by two further months where necessary because of complexity and number, with reasons given within the first month. Article 21(3) itself says marketing processing shall no longer take place for those purposes; that stop is not written as a one-month waiting period.