How can a company use my data?

When you sign up to buy something online, join a mailing list, donate to a charity or enter a competition, you are giving the organisation involved your personal data.

Depending on what permissions you give, that organisation might be able to:

  • hold your data and use it for direct marketing, such as email, post and phone calls
  • sell your data to third parties

Organisations hold personal data for a range of useful reasons necessary to provide a service, not just for marketing.

For many purposes, you would want companies to continue handling your personal information to perform the tasks you need them to do.

Article 21 right to object

Under Article 21 of the GDPR you can make a request to an organisation to stop processing your data for the purposes of direct marketing.

If you notify a company that you object to them processing your personal data for direct marketing purposes, it means they must stop, or not begin, sending you marketing material or contacting you for marketing purposes.

If an organisation ignores your Article 21 notice you can complain to the ICO

When can I use the right to object?

You can use Article 21 of the GDPR as an individual to put a stop to unwanted marketing, including junk mail, emails and nuisance calls.

But, there are usually steps you can take to stop direct marketing without resorting to a formal Article 21 notice:   

The first step you should take is to contact the organisation in question and ask to be removed from its marketing lists. This should be sufficient in most cases to stop unwanted marketing.

There are some companies who may offer to handle these types of notices for you, but we recommend avoiding these as they may charge for the service when you can exercise your rights for free.

You should know

  • Using an Article 21 notice won’t stop junk mail addressed ‘to the occupier’ – only post which is addressed with your name.  
  • An Article 21 notice should stop email and phone calls though. 
  • Telephone Preference Service (TPS): Marketers legally can't make unsolicited sales calls to any number registered with the TPS. But registration with the TPS won't override any specific consents you may have given.

How do I make an Article 21 notice?

You need to give the organisation enough information to identify you. This may be your full name, address, email address or other information, such as a loyalty card number.

We recommend doing this via email, that way you'll automatically have a copy of your notice and proof of posting.

You need to spell out that you're asking the organisation to stop (or not to begin) processing your personal data for direct marketing purposes in accordance with Article 21 of the GDPR.

Your notice should be dated and you should tell the organisation from what date you expect them to comply with your request.

In normal circumstances you can expect them to stop contacting you by email within 28 days of receiving your notice, and post to stop within two months.

GDPR Article 21 right to object template letter

Stop unwanted direct marketing, use our template letter to create an Article 21 right to object notice.

How do I make a subject access request?

An Article 15 subject access request also known as a SAR gives you the right to request information about the personal data that an organisation holds about you.

A subject access request allows you to find out what data an organisation has about you and how they use it.  

The right existed under the Data Protection Act 1998, but you had to pay. Under Article 15 of the GDPR you can now make subject access requests for free.

Find out more about subject access requests.

Please tell us what you think of the Which? Consumer Rights website.

Your feedback is vital in helping us improve this site. All data will be treated confidentially. This survey will take approximately 5 minutes to complete.

Please take our survey so we can improve our website for you and others like you.