2 of 5: How to Handle Objections to Direct Marketing Under UK GDPR
Under Article 21 of UK GDPR, individuals can object to direct marketing at any time. Learn how your company must respond — and what compliance looks like in practice.
Marketing teams rely on data to reach the right audience — but under Article 21 of the UK GDPR, individuals have an absolute right to object to direct marketing. Once a person opts out, companies must stop all marketing-related processing
📩 What Counts as Direct Marketing?
Direct marketing is broadly defined and includes:
- Email campaigns, newsletters, or product updates
- SMS, postal mail, or telephone sales
- Online behavioural advertising and social targeting
- Job role-based B2B outreach or lead scoring
If the purpose is to promote services or generate interest, it likely qualifies as marketing — even if it’s not overtly “salesy.”
🛑 Responding to a Marketing Objection
When someone exercises their right to object, your company must:
- Stop processing for marketing purposes immediately — no weighing of interests is required
- Confirm in writing that their objection has been actioned (if requested)
- Suppress their data from all future campaigns, not just delete it (to avoid re-marketing)
Many firms mistakenly remove individuals from their database entirely — but without proper suppression, the same person could be re-added later. Suppression lists (or “do not contact” flags) are a best practice.
⚠️ Compliance Risks
Failure to honour objections can lead to:
- Complaints to the Information Commissioner’s Office (ICO)
- Monetary penalties or enforcement action
- Reputational damage — especially in regulated sectors like finance and law
🧭 Practical Checklist
- Include a clear unsubscribe or objection mechanism in every email
- Automate suppression flagging in your CRM or ATS
- Train sales and recruitment teams to escalate objections properly
- Maintain a documented audit trail of all objections received
💡 Tip:
Don’t rely solely on unsubscribe links — offer an option to object to all marketing at the point of data collection, such as on your website or application forms. This helps ensure valid consent and shows regulatory maturity.
