Art. 21 GDPR · Chapter III: Rights of the data subject · Section 4: Right to object and automated individual decision-making
Article 21 GDPR: Right to object
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
The data subject may object to processing based on public interest or legitimate interests, and the controller must then stop unless it demonstrates compelling legitimate grounds or the processing is for legal claims. Where the data subject objects to processing for direct marketing, the data may no longer be processed for that purpose, and the right to object must be explicitly brought to the data subject's attention.
Official text
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-394/23, Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect
Judgment of 9 January 2025ECLI:EU:C:2025:2
Making customers state a title (Mr or Ms) to buy a train ticket is not necessary for the contract and cannot rest on legitimate interest where customers were not told of that interest, the data are not strictly necessary, or the risk of discrimination outweighs it; the right to object does not change the necessity test.
- C-26/22, UF and AB v Land Hessen
Judgment of 7 December 2023ECLI:EU:C:2023:958
Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review.
Related (earlier law or other instruments)
- C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)
Judgment of 24 September 2019ECLI:EU:C:2019:773
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
The ban on processing sensitive and criminal-offence data applies to search engines when they handle delisting requests; they must in principle delist such links unless a strict balancing, including the public's interest in the information, justifies keeping them.
- C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González
Judgment of 13 May 2014ECLI:EU:C:2014:317
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
A search engine operator processes personal data and is a controller for that processing; EU law applies where it has an establishment selling advertising in a Member State; and a person can ask it to remove links to information about them that is inadequate, irrelevant or no longer relevant, after a balancing of rights.
EDPB guidance
- Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
EDPB 01/2024Draft for consultationFirst published 9 October 2024
WP29 Opinion 06/2014 (WP217) interpreted Directive 95/46 and was not part of the EDPB's 2018 endorsement. Consultation closed 20 November 2024; as of 28 October 2026 the EDPB lists no final version.
- Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)
EDPB 05/2019FinalFirst published 11 December 2019Final version 7 July 2020
Fines
Amounts are shown in the currency in which the fine was imposed.
- Carrefour France: EUR 2,250,000
Commission nationale de l'informatique et des libertés (CNIL), FranceDecision of 18 November 2020Appeal status: unknown
Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings.
Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb_aar_2020_final_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both.