Practical guide
How to draft an objection to AI-based processing
4 min read · Updated June 2026 · Editorial oversight: Avv. Federico Papa
The objection to data processing, regulated by Art. 21 GDPR and supplemented by the protections in Art. 22 for automated processing, is the primary tool through which a data subject can prevent the continuation of processing activities based on legitimate interest or public interest tasks. Pursuant to Art. 12 GDPR, the controller must respond without undue delay, assessing whether their compelling legitimate grounds override the interests, rights, and fundamental freedoms of the applicant. This right is absolute only in cases of direct marketing, whereas in other instances it requires a specific weighting of concrete circumstances. The document aims to protect the individual's private sphere against processing activities perceived as invasive, no longer justified, or managed via automated decision-making systems.
In brief
Objection under Art. 21 GDPR and Art. 22 for automated processing allows data subjects to prevent activities based on legitimate interest or public interest tasks. The controller must respond per Art. 12 GDPR within one month, assessing overriding compelling legitimate grounds, except for direct marketing which is an absolute right. Challenging AI systems requires specific analysis of algorithmic logic and privacy impacts. Transmission occurs via certified email or registered mail, with subsequent rights to file complaints with the Data Protection Authority or ordinary courts.
The steps
- 1.
Verification of the legal basis for processing
The professional must first verify that the contested processing is based on the legal grounds provided for in Art. 6, par. 1, letters e) or f) of the GDPR. If the processing is based on express consent, an objection under Art. 21 is not the technically correct remedy and one must proceed with the withdrawal of consent; if based on the performance of a contract, this right is likewise not applicable. This verification is essential to avoid claims of inadmissibility by the data controller during the response phase.
- 2.
Analysis and specification of the particular situation
Except in the case of direct marketing, the data subject has the burden of specifying the reasons related to their particular situation that justify the cessation of processing. The controller can legitimately refuse the request if they demonstrate overriding compelling legitimate grounds, or for the establishment, exercise, or defense of legal claims. Omitting this analysis makes the request vulnerable to rejection based on the lack of balancing elements.
- 3.
Technical drafting of the grounds for objection
The description of the reasons must be precise and detailed, highlighting the prejudice or concrete risk suffered due to the processing of personal data. In the case of processing managed through AI systems, it is appropriate to specifically challenge the algorithmic logic and the impact on individual privacy under Articles 21 and 22 GDPR. A generic justification risks failing the mandatory balancing test provided by the GDPR for non-advertising processing activities.
- 4.
Formalization of the cessation request
The document must contain a formal notice to immediately cease all processing activities for the purposes under dispute. Art. 12 GDPR must be expressly cited to remind the controller of their duty to provide a transparent response within legal deadlines. The request must clearly specify whether the objection concerns all processed data or only specific methods or secondary purposes.
- 5.
Sending methods and burden of proof
The request must be transmitted through channels that guarantee certainty of date and proof of receipt, such as certified email (PEC) or registered mail with return receipt. Alternatively, it can be addressed to the Data Protection Officer (DPO) if their contact details are published in the privacy policy. Keeping the delivery receipt is a fundamental requirement for any subsequent complaint to the Data Protection Authority.
- 6.
Attachment of identification documents and powers of representation
The request can be accompanied by a copy of an identity document to prevent requests for supplementary information by the controller who, pursuant to Art. 12, par. 6 GDPR, has the power to request it in case of reasonable doubts regarding identity. This step prevents delays based on sender uncertainty. If the document is signed by a lawyer, it is essential to attach a special power of attorney to legitimize the power of representation.
Legal basis: Art. 21 GDPRArt. 22 GDPRArt. 6 GDPRArt. 12 GDPR
The template structure
The standard sections that make up the document. The full template can be opened and completed directly on edit.legal.
Sender
Full identification data of the data subject exercising the right to object.
Data Controller
Data of the controller and the DPO receiving the request for correct notification.
Subject: right to object
Clear indication of the exercise of rights under Articles 21 and 22 GDPR.
Grounds for objection
Details of specific reasons or indication of objection to direct marketing.
Cessation request
Explicit request for the immediate interruption of personal data processing.
Place, date, signature
Handwritten or digital signature with indication of the date and attachments.
Mistakes to avoid
- Omitting the description of the particular situation in cases where the objection does not concern direct marketing.
- Sending the request to a generic address instead of the specific contacts indicated in the policy or to the DPO.
- Failing to attach an identity document, which legitimizes the controller to request supplementary information in case of reasonable doubts regarding the applicant's identity.
- Confusing the right to object with the right to erasure, which relies on distinct legal requirements.
Frequently asked questions
What are the response deadlines for the Controller?
The Controller must respond within one month of receiving the request. This deadline may be extended by up to two additional months in complex cases; in any event, the data subject must be informed of the extension and the reasons for it within the first month.
Does an objection to marketing require specific justification?
No, objecting to processing for direct marketing purposes is an absolute and unconditional right that requires no explanation. The controller must cease advertising activities immediately upon receipt.
What happens if the Controller refuses the objection?
If the Controller deems their compelling legitimate grounds to be overriding, they must provide a detailed justification for the refusal. The data subject can then challenge the decision before the Data Protection Authority or the ordinary courts.
What edit.legal automates
- —Automatic generation of legal references to Articles 21, 22, 6, and 12 GDPR for every type of processing.
- —Dynamic adaptation of the text based on marketing or legitimate interest purposes with predefined balancing clauses.
- —Verification of response deadlines provided by European regulations with automatic reminders for follow-up management.
Put edit.legal to the test on actual cases
Try edit.legal for free on an active case. No credit card required.
Try edit.legal for freeThis guide is for informational purposes only and does not constitute legal advice for your specific case.