Objection and direct marketing
How to handle an objection under UK GDPR Art 21, which is absolute for direct marketing, together with the PECR rules on stopping electronic marketing and the suppression list that makes both stick.
- Applies to
- Any controller processing on public task or legitimate interests, and anyone sending direct marketing.
- Instruments
- UK GDPR, PECR, DPA 2018
- Steps
- 8 steps, with a deadline calculator.
Deadline calculator
Other data subject rights request
Rectification, erasure, restriction, portability, objection and automated decision requests: one calendar month from receipt, extendable by two further months for complex or numerous requests. Same counting as subject access.
Basis: UK GDPR Art 12(3) and Art 12A. Bank holidays for 2025 to 2028, by the standard calendar rules. A calculator, not advice.
Mechanics
| Item | Position |
|---|---|
| Deadline | One calendar month from receipt |
| Extension | Two further months for complex or numerous requests, notified within the first month |
| Stop the clock | While reasonably waiting for identity or clarification (Art 12A) |
| Cost | Free; a reasonable fee or refusal only if manifestly unfounded or excessive |
| Direct marketing | Absolute: stop on objection, no balancing (Art 21(2) and (3)) |
| Other processing | Stop unless compelling legitimate grounds override, or legal claims (Art 21(1)) |
| PECR | Opt-outs and TPS screening apply to the message itself |
Steps
-
Recognise the objection
An objection can be made in any form, including replying "stop" or clicking an unsubscribe link. Log the date.
See UK GDPR
-
Direct marketing: stop, without exception
If the objection is to direct marketing, including profiling for it, stop processing for that purpose. There is no balancing test and no exception.
See UK GDPR
-
Add the person to a suppression list
Keep the minimum data needed to make sure they are not marketed to again. Suppression is not erasure: deleting them entirely risks re-adding them from another list.
See UK GDPR
-
Apply PECR to the channel
Electronic mail must give a simple means of refusing in every message and honour it; marketing calls must not go to numbers that have objected or are on the Telephone Preference Service.
See PECR
-
Other processing: assess the grounds
For objections to processing on public task or legitimate interests, stop unless you can show compelling legitimate grounds that override the person's interests, rights and freedoms, or the processing is for legal claims. Restrict while you decide if asked.
See UK GDPR
-
Respond within one month
Confirm you have stopped, or explain the compelling grounds. Tell recipients where relevant.
See UK GDPR
-
Check transparency
The right to object must be brought to the person's attention explicitly, clearly and separately, at the latest at the first communication (Art 21(4)).
See UK GDPR
-
Handle any complaint
A dissatisfied requester complains to you first under your s.164A process (complaints received from 2026-06-19), then to the Information Commission.
See DPA 2018
Checklists and tools for this procedure
Lawful basis navigator
Start from what you are trying to do and get the UK GDPR basis to test first, with the extra condition you need for special category data.
Electronic marketing permission
Before an email, text or call campaign: which PECR route permits it, and are its conditions met?
Legitimate interests assessment
Run the three-part test for UK GDPR Art 6(1)(f), after first checking whether the purpose is a recognised legitimate interest that needs no balancing test.
Explainers
Sources
- Primary UK GDPR (Regulation (EU) 2016/679 as it applies in the UK) legislation.gov.uk
- Primary Privacy and Electronic Communications (EC Directive) Regulations 2003 legislation.gov.uk
- Primary UK GDPR Article 12 legislation.gov.uk