--- title: "Art. 21 GDPR: Right to object" canonical: "https://dposchool.com/gdpr/article/21" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_21" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 21 GDPR · Chapter III: Rights of the data subject · Section 4: Right to object and automated individual decision-making # Article 21 GDPR: Right to object Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) The data subject may object to processing based on public interest or legitimate interests, and the controller must then stop unless it demonstrates compelling legitimate grounds or the processing is for legal claims. Where the data subject objects to processing for direct marketing, the data may no longer be processed for that purpose, and the right to object must be explicitly brought to the data subject's attention. ## Official text ### Article 21(1) **1.** The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. ### Article 21(2) **2.** Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. ### Article 21(3) **3.** Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. ### Article 21(4) **4.** At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information. ### Article 21(5) **5.** In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. ### Article 21(6) **6.** Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 21 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_21) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 69](https://dposchool.com/gdpr/recital/69) ## Court of Justice judgments ### [C-394/23, Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect](https://dposchool.com/gdpr/case/c-394-23) Judgment of 9 January 2025 · ECLI:EU:C:2025:2 Making customers state a title (Mr or Ms) to buy a train ticket is not necessary for the contract and cannot rest on legitimate interest where customers were not told of that interest, the data are not strictly necessary, or the risk of discrimination outweighs it; the right to object does not change the necessity test. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-394/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0394) ### [C-26/22, UF and AB v Land Hessen](https://dposchool.com/gdpr/case/c-26-22) Judgment of 7 December 2023 · ECLI:EU:C:2023:958 Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-26/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0026) ### Related (earlier law or other instruments) #### [C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)](https://dposchool.com/gdpr/case/c-136-17) Judgment of 24 September 2019 · ECLI:EU:C:2019:773 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) The ban on processing sensitive and criminal-offence data applies to search engines when they handle delisting requests; they must in principle delist such links unless a strict balancing, including the public's interest in the information, justifies keeping them. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-136/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0136) #### [C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González](https://dposchool.com/gdpr/case/c-131-12) Judgment of 13 May 2014 · ECLI:EU:C:2014:317 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) A search engine operator processes personal data and is a controller for that processing; EU law applies where it has an establishment selling advertising in a Member State; and a person can ask it to remove links to information about them that is inadequate, irrelevant or no longer relevant, after a balancing of rights. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-131/12&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0131) ## EDPB guidance ### [Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR](https://dposchool.com/gdpr/guidance/edpb-01-2024) EDPB 01/2024 · Draft for consultation · First published 9 October 2024 WP29 Opinion 06/2014 (WP217) interpreted Directive 95/46 and was not part of the EDPB's 2018 endorsement. Consultation closed 20 November 2024; as of 28 October 2026 the EDPB lists no final version. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-12024-on-processing-of-personal-data-based-on-article-61f-gdpr_en) ### [Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)](https://dposchool.com/gdpr/guidance/edpb-05-2019) EDPB 05/2019 · Final · First published 11 December 2019 · Final version 7 July 2020 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-52019-on-the-criteria-of-the-right-to-be-forgotten-in-the-search_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [Carrefour France: EUR 2,250,000](https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 18 November 2020 · Appeal status: unknown Retailer kept customer data too long, gave unclear loyalty-programme information, failed to answer access, erasure and objection requests, and had security and breach-notification failings. Not fully confirmed: Deliberation SAN-2020-008 of 18 November 2020 (articles and date read there; anonymised). The amount (EUR 2,250,000) and the name are confirmed in the EDPB Annual Report 2020 (https://www.edpb.europa.eu/system/files/2021-06/edpb\_aar\_2020\_final\_27.05.21.pdf), not in the operative part. The decision also found a cookie breach under Article 82 of the French Data Protection Act and a breach of Article L34-5 of the Postal and Electronic Communications Code; the GDPR findings predominate, but the single fine covers both. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter III](https://dposchool.com/gdpr/chapter/3) / Article 21 Previous: [Art. 20 GDPR: Right to data portability](https://dposchool.com/gdpr/article/20) Next: [Art. 22 GDPR: Automated individual decision-making, including profiling](https://dposchool.com/gdpr/article/22) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents