Right to object to data processing (GDPR Art. 21)

The right to object (GDPR Art. 21) is your main defence against unwanted processing — and for direct marketing it's stronger than people realise. Two scenarios: (A) General objection against processing based on "legitimate interest" or "public interest" (Art. 6(1)(e) or (f)). The business must stop unless they can demonstrate compelling legitimate grounds overriding yours, or processing is necessary for legal claims. Burden of proof is on the business. (B) Objection to direct marketing (Art. 21(2-3)). This is absolute: once you object, they may never contact you again for marketing. No charging fees, no "one last email", no "are you sure?" pop-ups. Stop, period. Applies to email, post, phone, SMS, push notifications, personalised ads. How to object? In writing — email suffices. Most marketing emails include an "unsubscribe" link at the bottom (Art. 13 requires this). Doesn't work or you still get mail? Complain to the AP. Profiling: objection also covers profiling for direct marketing — e.g. retargeting ads. Important difference vs erasure: objection stops the processing, erasure deletes the data. Often you do both at once. Reasons required? For direct marketing, never. For general objection yes — explain why the processing particularly affects you (e.g. medical, financial or safety circumstances).