Art.21 Right to object
Where processing is based on the performance of a public interest task, official authority or legitimate interests, including profiling on those bases, the data subject may object at any time on grounds relating to their
5
artefacts
1
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- The automated objection mechanism offered on information society services · Data governance / DLP tooling
periodic reviewEvidence produced at each review
- Objection records that distinguish direct marketing objections, which are absolute, from Article 21(1) objections, which are balanced · Data governance / DLP tooling
governing documentDocuments that govern the control
- The compelling legitimate grounds analysis for every Article 21(1) objection that was refused · Policy repository / GRC workspace
- Evidence the right to object was presented clearly and separately at first communication, such as the template or screen as sent · Policy repository / GRC workspace
- Suppression list operation showing an objection propagates to every marketing channel and survives the next data import · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Data governance / DLP tooling on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- A direct marketing objection put through a balancing test, when Article 21(3) allows no balancing at all
- Suppression applied in one channel while the same person is marketed to again by another channel or through a partner list
- The right to object buried in a privacy notice rather than presented clearly and separately at first contact
- Suppression records deleted in the name of data minimisation, so the objection is lost and the person is contacted again
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.20 Right to data portability · Art.22 Automated individual decision-making, including profiling