Right to object

The lawful basis changes the answer

The right to object applies to processing based on public task or legitimate interests, including related profiling. The person should explain their particular situation, and the organisation must stop unless it demonstrates compelling legitimate grounds that override the person's interests, rights and freedoms, or needs the data for legal claims.

Direct marketing is stricter: once a person objects, the organisation must stop using their personal data for that purpose. The right does not operate in the same way for processing based on contract or legal obligation, although another right or challenge may fit the concern.

Recognise the request in ordinary language

An objection can be verbal or written. A worker might say, “Please stop using my location data to score attendance” without mentioning UK GDPR. Record when it arrived, the processing challenged, the basis relied on and any decision that depends on it.

The ICO's right-to-object guidance explains the response test and deadline. Verify identity proportionately and ask focused questions only when the processing or personal circumstances are unclear.

Pause, decide and apply the outcome

Consider whether processing should be restricted while the objection is assessed, particularly where the person also disputes accuracy or lawfulness. Gather the legitimate-interests assessment, purpose, necessity, effect and available alternatives.

Respond clearly with the decision and reasons. If the objection succeeds, stop the relevant processing and carry that instruction across systems and processors. If it is refused, explain the compelling grounds or legal-claims need and give the complaint route. Keep only the evidence needed to show how the request was decided.