What evidence do auditors commonly ask for on Art.21 Right to object?

Objection records that distinguish direct marketing objections, which are absolute, from Article 21(1) objections, which are balanced; The compelling legitimate grounds analysis for every Article 21(1) objection that was refused; Evidence the right to object was presented clearly and separately at first communication, such as the template or screen as sent; Suppression list operation showing an objection propagates to every marketing channel and survives the next data import; The automated objection mechanism offered on information society services.

What is the most common gap auditors find on Art.21?

A direct marketing objection put through a balancing test, when Article 21(3) allows no balancing at all

GDPR · Chapter III - Rights of the Data Subject

`Art.21` Right to object

Where processing is based on the performance of a public interest task, official authority or legitimate interests, including profiling on those bases, the data subject may object at any time on grounds relating to their particular situation, and processing must stop unless the controller demonstrates compelling legitimate grounds that override the data subject's interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims. Where personal data is processed for direct marketing, including profiling related to that marketing, the objection is absolute and processing for that purpose must stop with no balancing. Bring the right explicitly to the data subject's attention at the latest at the time of the first communication, presented clearly and separately from any other information. In the context of information society services, allow the objection to be exercised by automated means using technical specifications. A separate right to object applies to research and statistical processing under Article 89(1) unless that processing is necessary for a public interest task.

Source: GDPR, Art.21. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

hard

to go live

Data governance / DLP tooling

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Objection records that distinguish direct marketing objections, which are absolute, from Article 21(1) objections, which are balanced · Data governance / DLP tooling
The compelling legitimate grounds analysis for every Article 21(1) objection that was refused · Data governance / DLP tooling
Evidence the right to object was presented clearly and separately at first communication, such as the template or screen as sent · Data governance / DLP tooling

governing documentDocuments that govern the control

Suppression list operation showing an objection propagates to every marketing channel and survives the next data import · Policy repository / GRC workspace
The automated objection mechanism offered on information society services · Policy repository / GRC workspace

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

A direct marketing objection put through a balancing test, when Article 21(3) allows no balancing at all
Suppression applied in one channel while the same person is marketed to again by another channel or through a partner list
The right to object buried in a privacy notice rather than presented clearly and separately at first contact
Suppression records deleted in the name of data minimisation, so the objection is lost and the person is contacted again

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.20 Right to data portability · Art.22 Automated individual decision-making, including profiling