What is the right to object and when can I use it?

You can ask organisations to stop using your personal information. This is known as the ‘right to object’.

If you’ve previously consented to an organisation using your personal information and now want to withdraw that consent, the organisation must stop using it. You don’t need to submit a right to object request for this, you can just make it clear that you want to withdraw your consent. (Read our consent guidance for more information.)

Organisations can sometimes use your information without your consent, but this doesn’t mean you lose all control over it. You can submit a right to object request at any time to show that you want the organisation to stop using your personal information. However, it only needs to comply with your request in certain circumstances.

You have the right to object to organisations using your personal information if it’s for:

• sending advertising or marketing via any form of communication (eg emails, post, and calls) targeted at you specifically. Organisations cannot refuse if you object to this. This doesn’t apply to market research or routine customer service messages;
• exercising their official authority. This covers public functions and powers which are set out in law (eg government departments and local authorities); 
• a task carried out in the public interest. This can be by both private and public sector organisations;
• scientific or historical research, or statistical purposes (unless this is necessary to carry a task out in the public interest);
• their ‘legitimate interest’, which is a term used in data protection law. This can cover a wide range of scenarios, but organisations cannot simply decide that something is a legitimate interest. They must still be able to:
  • identify what their purpose is and why it’s legitimate;
  • justify why it’s necessary to use your personal information to achieve this purpose; and
  • balance their interests against yours, and ensure you are not unfairly disadvantaged by the use of your personal information to achieve this purpose; or
• a ‘recognised legitimate interest’. These are interests considered legitimate by default under data protection law. Organisations can use your information without assessing the impact on you if it’s necessary to achieve these purposes. But you can still object to this. These are:
  • prevention of crime;
  • protecting public security;
  • national security or defence;
  • safeguarding vulnerable people;
  • responding to emergencies; and
  • sharing personal information to help other organisations perform their public tasks or official functions.

You can’t object if the information is needed:

• for a contractual obligation between you and the organisation;
• for a legal obligation; or
• to protect your life or someone else’s life.

In practice, you may not know exactly why an organisation is using your personal information. You should be able to find this information in the privacy policy or privacy notice on its website. 

You may use the right to object if you want to stop an organisation from using your personal information for certain purposes, but not delete it altogether. If you want an organisation to delete your information instead, read our get your data deleted guidance.

Can I object to receiving advertising or promotional messages?

Yes. This is known as ‘direct marketing’ and organisations can’t continue to send you these messages if you object to them. This means they can’t carry on using your information to try to sell or promote things to you.

However, this doesn’t automatically mean that organisations need to erase all your personal information. It’s likely that organisations will put you on their ‘suppression list’. This is a list of people who’ve said they don’t want their information used for direct marketing.

Organisations can keep your name on a suppression list even if you have objected to direct marketing. This is to ensure they can comply with your request and won’t mistakenly send you direct marketing again.

How do I object?

To use your right to object, you should:

• contact the organisation directly;
• tell them what use of your information you’re objecting to; and
• explain why you’re objecting.

It’s important to be clear about what use of your information you’re objecting to and the reasons for objecting. Organisations may decide whether to comply with your request based on the information you give.

If you’re not sure how to get in touch with an organisation, you should be able to find its contact details in the privacy policy or privacy notice on its website.

You can make your request verbally or in writing at any time. We recommend you follow up any verbal request in writing because this allows you to:

• explain your request;
• provide evidence;
• explain what you want to happen; and
• prove what you’ve asked for, if you want to challenge the organisation’s response.

There are no specific words that you must use, but you may find it useful to use the template below to help you use your right to object.

You can ask someone else to submit the request for you, but they’ll need to send the organisation proof that they’re authorised to act on your behalf. An organisation may ask for:

• written permission from you that you have authorised the other person to act on your behalf; or
• a power of attorney document.

An organisation doesn’t have to comply with requests submitted on your behalf if it’s not satisfied that the other person has permission to act for you.

What response should I expect from organisations?

Organisations need to:

• deal with and respond to your objection within one calendar month;
• tell you if they need more time (they can extend up to two months for complex requests – for more on this see our guidance on time limits); and
• explain why they need extra time, if applicable.

Organisations may ask you to clarify the scope of your request or the outcome you’re looking for. 

Organisations might ask you for ID before dealing with your request. They shouldn’t ask for ID if your identity is obvious to them, and they should only ask for what’s reasonable and proportionate. The one-month time limit to respond starts once the organisation has received your ID.

If they ask you to provide further information or ID, you should provide it so they can deal with your request.

If your request is successful, organisations must stop or not begin using your personal information for the purpose you have objected to. However, they may still be able to continue using your information for other purposes. Organisations can’t refuse your request if you’re objecting to direct marketing.

When can organisations refuse my request?

Organisations may refuse your request if they:

• can demonstrate they have a strong reason to continue using your information;
• need your information for legal reasons or for a legal claim;
• need your information to comply with a contract between you and the organisation;
• need your information to save your life or someone else’s life;
• can rely on an exemption within data protection law. If an exemption applies, the organisation can either fully or partly refuse to comply with your request. Organisations don’t always have to tell you that they have used an exemption. (To find out more, read our guidance on exemptions, but please be aware it is written for organisations);
• believe your request is ‘manifestly unfounded’, which means they believe your request was made with no real purpose except to cause harassment or disruption; or
• believe your request is ‘excessive’, which means they believe the request overlaps or repeats the substance of a previous request that they have already dealt with appropriately. 

If they believe your request is manifestly unfounded or excessive, they should explain their reasoning to you. 

They should tell you the outcome of your request. If they’ve decided to continue using your information despite your objection, they should explain why.

Can organisations charge a fee for this?

Organisations can only charge a fee if the objection is ‘manifestly unfounded or excessive’. They may then ask for a reasonable fee to cover administrative costs associated with your request.

What should I do if an organisation doesn’t respond or I’m unhappy with the outcome?

If you’re unhappy with how an organisation has handled your request, you should first make a data protection complaint to it and give it the opportunity to resolve the matter. Organisations must:

• acknowledge your complaint within 30 days;
• inform you on the progress of your complaint; and
• give you an outcome without an unjustifiable or excessive delay.

If you remain dissatisfied, you can make a complaint to the ICO.

You can complain to us at any point, but we recommend giving the organisation a chance to complete its complaint handling process first. This gives it the opportunity to put things right.

You can also seek to enforce your rights through the courts. If you decide to do this, we strongly advise you to seek independent legal advice first.