What Are the Data Subject Rights Under the GDPR?
.png)
DPO Consulting Joins Grant Thornton
Summary
The GDPR right to object gives a person the power to stop processing of their personal data, without going to court and at no cost. Article 21 of the Regulation sets the conditions, Article 12 sets the deadlines.
For a business, the hard part is not the principle, it is the operation. Classify the request, check the lawful basis of the processing named, decide, document the decision and push the stop through every system, all within a month. This article walks through each step, from the data subject side and from the controller side.
The GDPR grants eight rights to data subjects, from the right to be informed to the right not to be subject to a fully automated decision. These GDPR data subject rights sit in Chapter III of the Regulation, Articles 12 to 22. The right to object is one of them and should not be confused with any of the others. The table below sets out each right, its article and what the person can obtain.
Some sources refer to 5 GDPR rights, others to 8 GDPR rights. The gap comes from how they are counted. Short lists merge information and access, or leave out the withdrawal of consent under Article 7(3) and the automated decision provision in Article 22. For a full breakdown of each of the GDPR data subject rights and its conditions, read our guide to data subject rights under GDPR.
Article 21 of the GDPR creates the right to object and splits it into two regimes. The first covers processing based on legitimate interests or on a public interest task, and is exercised on grounds relating to the person's particular situation. The second covers direct marketing, where the objection can be made at any time and needs no reason.
Two further obligations complete the provision. The right to object must be brought explicitly to the person's attention at the latest at the time of first communication, presented clearly and separately from any other information (Article 21(4)). In the context of information society services, the person must be able to object by automated means using technical specifications (Article 21(5)).
These requirements extend the transparency duties in Articles 13 and 14, which is why the objection route belongs in the privacy notice itself. Our guide to drafting a GDPR privacy policy covers how to present it.
The GDPR right to object applies in four situations, set by the lawful basis of the processing and by its purpose. The lawful basis decides everything. If the processing rests on a contract, a legal obligation or consent, Article 21 does not apply and the request has to be reclassified. The table below compares the three objection regimes and the room an organisation has to refuse.
A person can object to any processing based on legitimate interests, including profiling based on that ground, on grounds relating to their particular situation. The controller must then stop, unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the person. The burden of that demonstration sits with the controller, not with the requester.
An objection to direct marketing is absolute. As soon as the person objects, the data is no longer processed for those purposes, including profiling connected to that marketing. No compelling legitimate ground can be argued, and no justification can be demanded from the requester. The expectation is removal from the marketing database without delay, not at the end of the month.
Where data is processed for scientific or historical research purposes under Article 89(1), the person can object on grounds relating to their particular situation. The processing can continue in one case only, where it is necessary for the performance of a task carried out in the public interest. A publicly funded research protocol is not enough on its own, the necessity has to be established.
The same regime applies to processing for statistical purposes under Article 89(1). In practice, organisations that reuse customer data for internal analysis need to check whether that analysis genuinely falls under Article 89(1) or under their own legitimate interests. The classification changes which rule applies and what the answer to the request should be.
The right is exercised directly with the organisation processing the data, with no required format and no fee. The practical route is the organisation's rights page or the contact details of the data protection officer, followed by keeping evidence of the request. The four points below cover the questions that most often stall a request.
The request can be sent electronically, through a form, through an online account or by post. The Regulation imposes no format. The person names the processing concerned and, outside marketing, the grounds relating to their particular situation. An acknowledgement is not mandatory, but it fixes a defensible start date for the one month clock.
The person provides enough to identify the processing and their own record, for example a customer number or the email address concerned. Identity documents are not required as a matter of course. A controller can ask for additional information only where it has reasonable doubts about the identity of the requester, under Article 12(6). Identity checks do not pause the response deadline.
The GDPR imposes no form on the request, so a verbal objection is valid. It is harder to evidence. An organisation that takes an objection by phone or in branch should log it, timestamp it and route it into the same workflow as written requests, otherwise the clock runs while nobody handles the request.
Yes, a person can appoint a third party, such as a lawyer or an association, to exercise the right for them. The organisation can then ask for proof of the mandate and for the identity of the person represented. The same logic applies to access requests, covered in our guide to data subject access requests (DSAR).
The controller responds without undue delay and at the latest within one month of receiving the request, under Article 12(3). That period can be extended by two further months where the request is complex or where there are many requests, provided the person is told about the extension and the reasons for it within the first month. Three points shape exercising GDPR rights on this front.
A refusal is only possible outside direct marketing, and only on one of the grounds the Regulation allows. The refusal must be reasoned, documented and notified within the one month deadline. An unreasoned refusal is a finding in an inspection, even where the person suffered no harm.
A controller can continue processing where it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the person. The bar is high, the text says compelling, not merely commercial. The demonstration builds on the balancing test already carried out to establish the legitimate interest, refreshed for the individual case.
Processing can also continue where it is necessary for the establishment, exercise or defence of legal claims. That exception covers an identified or reasonably foreseeable dispute, not indefinite retention as a precaution. For research and statistics, it is the necessity of a public interest task that allows processing to continue.
The objection under Article 21(6) only covers processing framed by the safeguards in Article 89(1), such as data minimisation and pseudonymisation. An organisation relying on that regime has to show those safeguards are genuinely in place. Where they are not, the processing sits on legitimate interests and the stricter Article 21(1) regime applies.
A refusal, or no answer after a month, opens three routes to take in order. Chase the organisation, go to the supervisory authority, then bring a judicial remedy. Keeping a record of every exchange determines what is possible next.
Ask in writing for the exact basis of the refusal, citing Article 12(4). The organisation has to state the reasons for not acting. This step often untangles a request that was misclassified internally, for example a marketing objection handled by mistake as a general objection.
Where there is no satisfactory answer within a month, the person can lodge a complaint with the supervisory authority of their Member State, under Article 77. In France that is the CNIL. The complaint rests on a copy of the original request and on the answer received. The authority can order the organisation to comply and, where warranted, impose a sanction.
Article 79 provides an effective judicial remedy against a controller or processor, independent of any complaint to a supervisory authority. Article 82 separately allows a claim for compensation for material or non-material damage suffered. Both routes can run in parallel.
Where the problem is systemic rather than individual, for example an unsubscribe form that does not work, report the failure to the organisation's data protection officer. Repeated complaints about the same mechanism draw the attention of the supervisory authority, which feeds into its annual inspection priorities.
Since 11 August 2026, cold calling consumers in France is prohibited without prior consent, and the Bloctel opt-out service has closed. The rule comes from Article 13 of Law no. 2025-594 of 30 June 2025, which rewrites Article L223-1 of the French Consumer Code, completed by Decree no. 2026-662 of 23 July 2026 on collecting, storing and withdrawing that consent.
The shift matters beyond telephone campaigns. For consumer calls, an opt-out logic gives way to a traceable consent logic that has to be evidenced call by call. The Article 21(2) right to object still governs other channels, email and postal mail in particular, while withdrawal of consent becomes the central mechanism on the phone side. Any company marketing to consumers in France now has to hold both registers, objections and consents, in the same system.
A well run GDPR right to object process comes down to four things, a workflow, an audit trail, technical propagation and a regular review. Enforcement in this area rarely turns on a debatable legal position, it turns on lost requests and missed deadlines.
Set a single entry point, a named owner and an internal deadline shorter than the legal month, for example fifteen days. The first step in the workflow has to be classification, Article 21(1) objection, marketing objection or withdrawal of consent, because everything downstream depends on it.
Log the date of receipt, the channel, the processing named, the analysis carried out, the decision and the date of response. That documentation is the only usable evidence in an inspection. It also surfaces repeat requests against the same processing, a sign that a notice or an unsubscribe mechanism is failing.
A marketing objection has to propagate to the CRM, the email platform, advertising platforms and any files shared with suppliers. Re-importing old lists regularly reactivates contacts who had objected. A central suppression list, applied on every import, prevents that.
Test the real journey of a request twice a year, from the public form through to the answer sent. Check at the same time that privacy notices present the right to object separately, as Article 21(4) requires. Our GDPR compliance checklist covers these controls in a wider frame.
DPO Consulting has supported European and international organisations on GDPR compliance for more than ten years, with over 50 in-house experts. Support on exercising GDPR rights covers drafting the procedures, classifying requests, training marketing and support teams, and testing unsubscribe mechanisms end to end.
To find out where your gaps are, start with a GDPR compliance audit, which reviews your processing activities, your lawful bases and your request handling workflow. You can also talk to a GDPR expert at DPO Consulting to pressure test your objection procedure before your next campaign.
One month from receipt of the request, under Article 12(3) of the GDPR. That can be extended by two further months for a complex request, provided the person is informed within the first month. For direct marketing, the expectation is removal from the database without delay rather than at the end of the month.
Yes, where the profiling rests on legitimate interests or on a public interest task, or where it is connected to direct marketing. In the marketing case the objection is absolute. Profiling based on consent falls under withdrawal of consent, not under the right to object.
The organisation classifies the request, checks the lawful basis of the processing named and decides. During that check, the person can ask for restriction of processing under Article 18(1)(d). The answer has to state either that the processing has stopped, or the reasons for refusal and the remedies available.
Partly. Article 21 allows an objection to profiling based on legitimate interests. A decision based solely on automated processing that produces legal effects falls under a separate right, Article 22, which gives the person human intervention and the ability to contest the decision.
No. Where processing rests on consent, the correct route is withdrawal of consent under Article 7(3), which must be as easy to do as giving consent was. Supervisory authorities including the CNIL make this point explicitly when setting out the limits of the right to object. Our article on GDPR data consent covers the conditions for valid consent and for withdrawal.
Both figures circulate, the Regulation itself sets out eight in Chapter III. References to 5 GDPR rights are simplified consumer-facing lists. References to 8 GDPR rights follow the structure of the text, information, access, rectification, erasure, restriction, portability, objection and automated decision-making.
.png)
.svg)
.png)
.png)
