The Right to Object to Direct Marketing: What UK Businesses Must Do

Most GDPR rights involve a balancing exercise. The right to erasure has exemptions. The right of access has a response window. But one right has no balancing test and no carve-outs: the right to object to direct marketing.

Under Article 21(2) of the UK GDPR, a person has the right to object at any time to processing for direct marketing purposes — and Article 21(3) then requires that, once they object, the data "shall no longer be processed for such purposes." You must stop immediately. There is no legitimate interest to weigh against it. No business case to make. No delay permitted. The request is a veto and it is absolute.

Where the right to object comes from

Article 21 of the UK GDPR gives individuals the right to object to processing carried out on the basis of legitimate interest (Article 6(1)(f)) or public task (Article 6(1)(e)). The general rule under Article 21(1) requires the controller to stop processing unless it can demonstrate compelling legitimate grounds that override the individual's interests — so there is normally a balancing element. The ICO's guidance on individual rights covers the full scope: Individual rights under the UK GDPR.

Article 21(2) removes that balance for direct marketing: it gives the data subject "the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing." Article 21(3) then makes the consequence absolute: "Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes."

No exceptions. No competing interest test. No business justification.

What "direct marketing" means here

The ICO defines direct marketing broadly: "the communication (by whatever means) of any advertising or marketing material which is directed to particular individuals." This covers email, post, SMS, and telephone calls — not just digital channels.

The right to object under Article 21(2) applies to any processing for direct marketing purposes, including:

The email send itself
Profiling carried out for the purposes of direct marketing (expressly within Article 21(2))
Segmentation, list building, and other processing activities that serve the marketing purpose

If someone objects to marketing, you must stop all these activities in respect of them — not just the email sends.

What "immediately" means in practice

The ICO's guidance on the right to object states that you must stop processing "without undue delay." The ICO has indicated in enforcement action that "undue delay" is measured in days, not weeks — and that holding an objection for a "next batch processing" cycle is not acceptable.

Practically, this means:

Your suppression mechanism must operate faster than your marketing cycle. If you send a weekly email, an objection received on Thursday must be processed before the following week's send — not at next month's list refresh.

You must not re-add contacts who have objected. If a contact is suppressed because of a direct marketing objection, they must not be re-added if you purchase a list that includes them, or if they subscribe to a different product in your portfolio, without handling the suppression first.

The objection must carry across systems. If you hold contact data in a CRM, an ESP, and a data warehouse, an objection must flow to all three — not just the platform that received the opt-out.

The difference between an objection and a PECR opt-out

There are two separate mechanisms that affect whether you can send marketing emails:

PECR opt-out: Under PECR Regulation 22(4), anyone can require you to stop sending marketing emails, and you must do so. This is a PECR right — it does not delete the data, and PECR alone does not prevent you using the data for other purposes.

GDPR Article 21 objection: This is a UK GDPR right. Where it is exercised for direct marketing, you must stop all direct marketing processing — not just email. You are not required to delete the data, but you must stop using it for marketing.

An unsubscribe click in an email typically triggers the PECR opt-out. An Article 21 objection may be expressed in any form — an email to your data protection contact, a request submitted through your privacy centre, or a written request. Both must be processed promptly, but their scope differs.

Important: For contacts on your list because of legitimate interest (rather than consent), their Article 21 objection right is absolute and immediate. For contacts who gave consent, withdrawal of consent under Article 7(3) is the operative mechanism — but the practical outcome is the same: you must stop. An unsubscribe covers both.

What to do when you receive an objection

Record the objection immediately — date, contact details, channel through which it was received
Suppress the contact — remove them from active marketing in all systems without delay
Confirm suppression — ideally send the contact a brief confirmation that their objection has been recorded and will be honoured
Apply the suppression across systems — CRM, ESP, data warehouse, any third party processors holding the data for marketing purposes
Do not re-add them — maintain the suppression record permanently unless the contact later re-consents

The consent records retention guide covers how long to retain objection records and in what format.

Telling people about the right

Article 21(4) of the UK GDPR requires that you inform data subjects of their right to object to direct marketing "at the latest at the time of the first communication." In practice, this means:

Your privacy notice must describe the right to object to direct marketing
The first marketing email you send should make clear how to exercise the right (typically via an unsubscribe link, with a pointer to more formal objection routes)

Many organisations meet this with a standard unsubscribe footer. This is generally sufficient for most contacts — but where you are processing under legitimate interest (rather than consent), the right to object carries more legal weight and should be clearly described.

What happens if you ignore an objection

Ignoring a direct marketing objection is one of the clearest GDPR violations there is — it has no ambiguity, no exceptions, and no reasonable defence. ICO enforcement in this area has been consistent: post-objection marketing contacts attract enforcement attention quickly.

With the DUAA 2025 increasing the maximum PECR fine from £500,000 to £17.5 million or 4% of global annual turnover — a penalty structure that also applies to UK GDPR enforcement under the ICO's remit — the financial consequences of systematic objection failures are substantially higher than they were before February 2026. Our guide to DUAA 2025 PECR changes covers the full penalty regime change.

Legitimate interest and the right to object

Where you rely on legitimate interest as your GDPR basis for any marketing processing, the right to object is the key individual safeguard. The ICO's view is that the absolute nature of this right is one of the reasons legitimate interest is an appropriate basis for direct marketing — the individual retains full control to stop it at any time.

This also means that your legitimate interest assessment should address how you will honour objections — including your suppression mechanism, your cross-system propagation process, and your re-contact controls. See our legitimate interest assessment template for where this fits in the LIA documentation.

This article is for informational purposes only and does not constitute legal advice. For guidance specific to your situation, consult a qualified legal professional or data protection officer. Legislative references verified against legislation.gov.uk and ICO guidance as at August 2026.