Right to object: stopping processing, including marketing

Section 48 of the Data Protection Act, 2024 actually covers two different rights, and the difference between them matters. One is a general right to object, which a business can sometimes override if it has strong enough grounds. The other is a right to object to direct marketing, which it cannot override at all.

The general right to object

Section 48(1) gives a data subject the right to object to processing that is based on the public-interest or legitimate-interests grounds under section 26(e) or (f):

The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data concerning him or her which is based on section 26 (e) or (f), including profiling based on those provisions. (s.48(1))

This is not an automatic stop. Section 48(2) lets the controller keep processing anyway if it can demonstrate compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or that it needs to keep processing to establish, exercise or defend a legal claim. So a general objection shifts the burden onto the business to justify continuing, but does not guarantee the processing stops.

The direct marketing objection is much stronger

Where personal data is processed for direct marketing, section 48(3) and (4) work differently:

Where personal data is processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, including profiling related to such direct marketing… Where the data subject objects to processing for direct marketing purposes, his or her personal data shall not be processed for such purposes. (s.48(3)-(4))

There is no override test here. Once someone objects to being marketed to, that has to stop, full stop, and it covers any profiling connected to the marketing as well as the marketing messages themselves. See direct marketing for how this fits into the marketing rules more broadly.

Section 48(5) also puts a duty on the business rather than the data subject: these rights, both the general one and the marketing one, have to be explicitly brought to the data subject’s attention the first time the business communicates with them, and presented clearly and separately from other information, not buried in a footer or a privacy policy nobody reads.

Objecting to research and statistics

Section 48(6) gives a related, narrower right: where data is processed for scientific, historical or statistical research purposes, a data subject can object to that processing on grounds relating to their particular situation, unless the processing is in the public interest.