When you buy something online, join a mailing list, donate to a charity or enter a competition, you are giving the organisation involved your personal data.
Depending on what permissions you give, that organisation might be able to:
Organisations hold personal data for a range of useful reasons necessary to provide a service, not just for marketing.
For many purposes, you would want companies to continue handling your personal information to perform the tasks you need them to do.
If you notify a company that you object to them processing your personal data for direct marketing purposes, it means they must stop, or not begin, sending you marketing material or contacting you for marketing purposes.
You can use Article 21 of the GDPR as an individual to put a stop to unwanted marketing, including junk mail, emails and nuisance calls.
But, there are usually steps you can take to stop direct marketing without resorting to a formal Article 21 notice:
The first step you should take is to contact the organisation in question and ask to be removed from its marketing lists. This should be sufficient in most cases to stop unwanted marketing.
There are some companies who may offer to handle these types of notices for you, but we recommend avoiding these as they may charge for the service when you can exercise your rights for free.
You need to give the organisation enough information to identify you. This may be your full name, address, email address or other information, such as a loyalty card number.
We recommend doing this via email, that way you'll automatically have a copy of your notice and proof of posting.
You need to spell out that you're asking the organisation to stop (or not to begin) processing your personal data for direct marketing purposes in accordance with Article 21 of the GDPR.
Your notice should be dated and you should tell the organisation from what date you expect them to comply with your request.
In normal circumstances you can expect them to stop contacting you by email within 28 days of receiving your notice, and post to stop within two months.
An Article 15 subject access request also known as a SAR gives you the right to request information about the personal data that an organisation holds about you.
A subject access request allows you to find out what data an organisation has about you and how they use it.
The right existed under the Data Protection Act 1998, but you had to pay. Under Article 15 of the GDPR you can now make subject access requests for free.