This document reflects the UK GDPR regime. References and links to the GDPR refer to the UK GDPR (Assimilated Regulation (EU) 2016/679) unless expressly stated otherwise.

The UK General Data Protection Regulation (UK GDPR) provides a number of rights for data subjects, including providing a right to object.

Data subjects can make a request to an organisation to exercise their right to object to processing at any time. This is not, however, an absolute right to object—it only applies in specific circumstances. There are strict time limits for complying with requests made. See Practice Notes:

1. •

   Data subject rights—objection to processing

2. •

   How to handle data subject requests

This Flowchart maps out a process for evaluating a data subject request under the right to object that your organisation receives under the UK GDPR. It reflects the requirements in the UK GDPR and the Data Protection Act 2018 (DPA 2018) together with guidance issued by the Information Commissioner’s Office (ICO). It should be read in conjunction with Practice Note: How to handle data subject requests