ICO updates guidance on the right to object
The ICO has updated its public-facing guidance on the right to object to reflect the changes made by the Data (Use and Access) Act 2025. The guidance explains when an individual can ask an organisation to stop using their personal information and distinguishes an objection from the withdrawal of consent.
An objection to the use of personal information for direct marketing must be honoured. This applies to advertising or marketing targeted at an identifiable individual through channels such as email, post or telephone, although it does not necessarily extend to market research or routine customer-service communications.
Organisations should ensure that objections are recorded through reliable suppression processes, rather than simply deleting the person’s details and risking their subsequent reintroduction into a marketing database.
The position is more contextual where processing is based on legitimate interests, the performance of a public-interest task or the exercise of official authority. In such cases, the organisation may sometimes continue processing if it can demonstrate compelling legitimate grounds that override the individual’s interests, rights and freedoms, or where the processing is needed in connection with legal claims. The response should document the balancing exercise actually undertaken rather than relying on a generic statement that the organisation has a legitimate interest.
Compliance teams should review privacy notices, rights-request procedures and staff guidance to ensure that objections are correctly identified and distinguished from requests for erasure, restrictions on processing and withdrawals of consent. Marketing, customer-service and complaints teams should also know how to recognise an objection made informally: individuals do not need to quote the UK GDPR or use a prescribed form to exercise the right.
Olivia Whitcroft, who wrote the chapter on the rights of individuals in the forthcoming seventh edition of Data Protection – a Practical Guide to UK Law (Oxford University Press), said: “Organisations should review how they provide individuals with information about their right to object, ensuring they are clear about specific processing activities and their lawful basis (including the new recognised legitimate interest), so individuals are able to understand when they may exercise this right.”
A session on ‘Complaint Handling and Other Changes Post-DUAA: Realities of the New Approach’ will take place at PDP’s 25th Annual Data Protection Compliance Conference (23rd, 24th and 25th September). For further details see the website
