ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The legitimate interests right to object is the safety valve that makes the legitimate interests lawful basis workable. When you process personal data on that basis, you are deciding on the individual’s behalf that your interests outweigh their privacy. Article 21 of the GDPR lets the person disagree, and when they do, the balance you struck in your assessment no longer settles the matter. You must stop unless you can show something stronger.
This guide explains when the right applies, how the test changes once someone objects, why direct marketing is treated differently, what deadlines apply, and how to build a handling process that keeps your legitimate interests assessment honest.
Free gap assessment
Could you demonstrate GDPR compliance today?
Score yourself against what a supervisory authority actually asks for, free — the records, not the policy.
Run the free GDPR gap assessment → or View premium report sample
Article 21(1) gives individuals the right to object, on grounds relating to their particular situation, to processing based on Article 6(1)(e), the public task basis, or Article 6(1)(f), legitimate interests. That includes profiling based on those provisions. The words “particular situation” matter: the objection should explain why the processing affects this person in a way your general assessment did not anticipate, such as a safety concern, a sensitive personal circumstance or a specific harm.
The right does not apply to processing based on consent, contract or legal obligation. Consent has its own mechanism, because the person can simply withdraw it, and the right to object is the corresponding mechanism for processing you justified yourself. Our guide to legitimate interests versus consent explains how that choice affects your obligations.
Before anyone objects, you run a legitimate interests assessment: purpose, necessity and balancing. After an objection, the standard rises. You must stop processing the person’s data unless you demonstrate compelling legitimate grounds for the processing which override their interests, rights and freedoms, or unless the processing is needed for the establishment, exercise or defence of legal claims.
| Original assessment | After an objection | |
|---|---|---|
| Question | Do our interests outweigh theirs? | Do compelling grounds override this person’s interests? |
| Who decides | The controller, in advance | The controller, on the specific facts, and the burden is on you |
| Information used | General expectations of typical individuals | The individual’s stated situation as well |
| Default outcome | Processing may go ahead | Processing stops unless you can show compelling grounds |
| Record | The assessment document | A documented decision for each objection |
The practical consequence is that the burden of proof sits with you. If you cannot explain in writing why your grounds are compelling for this individual, you should stop. Read the wording for yourself in the text of GDPR Article 21.
The standard is deliberately demanding, and ordinary commercial convenience will rarely meet it. Situations that may qualify include processing needed to prevent or investigate fraud involving the person, to protect the security of a network they use or to keep accurate records needed for a live legal dispute. Situations that usually do not qualify include wanting to keep a customer for analytics, avoiding the effort of deleting data or preferring one marketing channel. Record the specific facts you relied on and avoid generic statements such as “we have a business need”.
Article 21(2) and (3) create an absolute right to object to processing for direct marketing, including profiling related to it. When someone objects, you must stop using their data for that purpose. There is no balancing test and no compelling-grounds exception. That is why relying on legitimate interests for marketing is safe only if you can honor the legitimate interests right to object immediately and everywhere.
In practice, keep a suppression list. Storing the minimum needed, typically the contact detail and the fact of the objection, is what allows you to make sure the person is not contacted again. Deleting everything can cause the person to be re-added from a purchased list or a new sign-up. Include the suppression step in every campaign workflow and every data import.
Article 12 sets the timing for responding to individuals exercising their rights. You must act without undue delay and in any event within one month of receiving the request. You may extend that by up to two further months where necessary, taking into account the complexity and number of requests, but you must tell the individual about the extension and the reasons within the first month. The response should be free of charge unless the request is manifestly unfounded or excessive.
If you decide not to act, you must explain why and tell the person that they can complain to a supervisory authority and seek a judicial remedy, all within the same one-month period. Log the date the objection was received, because that starts the clock, and route any message that sounds like an objection, even if it does not use the term, to the person who handles rights requests.
An objection interacts with other rights. While you verify whether your grounds override the person’s, they can ask you to restrict processing under Article 18(1)(d). If the objection succeeds and there are no overriding grounds, the person can also request erasure under Article 17(1)(c). Treat the objection as a package: one message can trigger several obligations, and your response should address each.
You must make the legitimate interests right to object visible. Article 21(4) requires that it be explicitly brought to the attention of the individual at the latest at the time of the first communication, and presented clearly and separately from other information. Your privacy notice must also state the legitimate interests you pursue when you rely on that basis, so that people can judge whether to object. Check your notices, your welcome emails and your marketing footers to make sure the right is stated where people will see it. Our guide to legitimate interests examples shows how organizations describe their interests in practice.
Objections are data, and tracking how often the legitimate interests right to object is used tells you whether your assessment still holds. If many people object to the same processing, your original balancing probably underestimated the impact or overestimated what people expect. Count objections per purpose each quarter, review the reasons and update the assessment where a pattern appears. Record the review date. A legitimate interests assessment that never changes despite steady objections looks like a paper exercise.
If you have not documented the balancing test at all, start there. Our legitimate interests assessment example and assessment template show what a complete record contains.
A strong assessment makes objections easier to handle, because the reasoning you need is already written down. The Legitimate Interests Assessment Report and Workbook gives you a structured report covering screening, purpose, necessity and balancing tests, safeguards and a live workbook for your own processing activities.
Yes. The right can be exercised whenever the processing relies on legitimate interests, and the person must give grounds relating to their particular situation, except for direct marketing where no grounds are needed.
You must stop unless you demonstrate compelling legitimate grounds that override the person’s interests, rights and freedoms, or the processing is needed for legal claims. For direct marketing you must always stop.
One month from receipt, extendable by up to two further months for complex or numerous requests, provided you tell the person about the extension and the reasons within the first month.
No. Consent-based processing is ended by withdrawing consent, while the right to object applies to processing you justify under legitimate interests or the public task basis.
Keep the minimum needed to honor the objection, typically the contact detail and a note of the objection, so the person is not contacted again through another channel or list.
September 30, 2026
