When Can You Keep a User's Data After They Object?

A user objects to your processing, and someone reaches for the delete button. That is often the wrong response. Under the UK GDPR, an objection can require you to stop a particular use of personal data, but it does not automatically require erasure. Objection, restriction and erasure are different rights, with different tests.

The answer starts with two questions: what processing did the person object to, and which lawful basis are you relying on? Without those, "we received an objection" is not yet a useful legal analysis.

First, identify what the objection actually covers

Article 21 covers objections to processing based on legitimate interests or public task, including profiling based on those grounds. It also covers direct marketing, where the right is stronger. The ICO's guidance on the right to object says an objection can relate to all the data you hold, particular information, or only a particular purpose.

That scope matters. "Do not use my details for marketing" is not necessarily an objection to storing an invoice. "Do not use my location history for fraud scoring" is not necessarily an objection to retaining an account record required by law.

Record the request in terms of purpose, data and operation. A useful internal note might say:

• Purpose: behavioural profiling for advertising.
• Data: browsing events and account identifier.
• Operation: sharing with the advertising platform.

That is much easier to assess than a single flag called objected = true. The flag may still be useful, but it is not the analysis.

Direct marketing is the easy case

If the processing is for direct marketing, the person can object at any time and you must stop using their data for that purpose. This includes profiling related to the marketing. There is no balancing exercise in which your campaign's expected revenue defeats the objection.

Stopping marketing does not usually mean deleting the person's contact details. You may need to retain a small suppression record, such as an email address and a do-not-contact marker, so that the next import does not quietly put them back on the mailing list. The ICO explicitly describes suppression as retaining enough information to respect the person's preference in future.

Keep the minimum suppression data needed. Do not retain a whole customer profile merely because one field is useful for preventing future marketing. Separate the suppression store from campaign data, restrict access, and give it its own retention review.

Legitimate interests requires a second look

For an objection to processing based on legitimate interests, the person must give reasons relating to their particular situation. The right is not absolute. Article 21 says you can continue only if you demonstrate compelling legitimate grounds that override the person's interests, rights and freedoms, or if the processing is needed for the establishment, exercise or defence of legal claims.

This is a higher bar than repeating the original legitimate interests assessment. Before the objection, you may have concluded that a modest amount of fraud monitoring was necessary and reasonably expected. After the objection, you must consider the person's stated circumstances and whether your reason still outweighs them.

Quick detour: "legitimate interest" does not mean "the business would like to do this". The ICO describes a three-part test: identify a legitimate interest, show that the processing is necessary, and balance it against the person's interests, rights and freedoms. Article 21 then asks whether your grounds are compelling enough to continue after a specific objection.

A generic statement such as "we need this for security" is unlikely to do much work by itself. Explain what threat you are addressing, why this person's data is necessary, what safeguards reduce the impact, and why a less intrusive alternative would not achieve the same result.

A legal obligation can let you retain the record

Article 21 does not provide a general veto over processing based on every lawful basis. If you must retain data to comply with a legal obligation under Article 6(1)(c), an objection under Article 21 is not the mechanism that cancels that obligation.

For example, a request to delete a paid invoice does not automatically override accounting or tax record-keeping requirements. The exact retention period and records required depend on the circumstances and the relevant law, so do not invent a universal "seven-year GDPR rule". There is no general UK GDPR retention period that applies to every business record.

You still need to follow storage limitation and data minimisation. Retain the record required for the obligation, not every related event, support note and copied export. The ICO's guidance on the storage limitation principle says personal information should not be kept longer than the organisation needs it and that retention criteria should be explained where a fixed period is not available.

Legal claims are the clearest reason to keep data

Article 21 expressly allows continued processing for the establishment, exercise or defence of legal claims. That can cover preserving evidence, handling a complaint that may become litigation, responding to a claim, or protecting the organisation's legal position.

It does not turn every speculative concern into a permanent archive. "We might get sued one day" is not a retention schedule. Identify the actual dispute or credible risk, the relevant records, the people who need access, and a review date.

Where the wider use should stop but the evidence must survive, restriction is often the cleaner answer. Article 18 allows processing to be restricted in certain circumstances. Restricted data may generally be stored, but other processing is limited to purposes such as legal claims, protecting another person's rights, consent, or important public interest reasons.

Preserve evidence narrowly, then restrict it. A legal hold should not quietly become permission to keep using the data for analytics, product experiments or staff training.

Contract, consent and public task need separate handling

If processing is necessary to perform a contract, Article 21 is not the applicable objection route. That does not mean the organisation wins every argument. The processing must still be necessary, transparent and fair, and other rights may apply, including erasure or restriction in the circumstances set out by the UK GDPR.

Consent works differently again. If the person withdraws consent, you normally need to stop the processing that depended on it. That is not technically the same as an Article 21 objection, and you cannot keep relying on consent after it has been withdrawn.

Public authorities also need to distinguish public task from legitimate interests. Article 21 applies to public-task processing, subject to the compelling-grounds test, but the exact public-task basis and statutory powers matter. This is one of the places where a label in a privacy notice is not enough; the underlying legal authority has to fit the activity.

Turn the objection into an operational decision

A workable process should make the decision visible rather than hiding it in an inbox. For each objection, work through these questions:

1. What purpose, data and operation did the person object to?
2. What lawful basis supports that operation?
3. Is this direct marketing, where the objection is absolute?
4. If it is legitimate interests or public task, what specific grounds justify continuing?
5. Can you stop active use while retaining a restricted record?
6. What data can be deleted, separated, anonymised or suppressed?
7. When will the decision and any retention be reviewed?

Tell the person what you decided and why. The ICO says organisations should explain a refusal and inform the person about their right to complain to the ICO or seek a judicial remedy. You normally have one calendar month to respond to an objection.

One final practical trap: deleting the row in the main database does not necessarily stop the processing. Search exports, CRM replicas, support tools, backups and downstream processors. If you retain data for a legal obligation or claim, document that narrow reason. If you stop the purpose, make sure the corresponding jobs, indexes and data feeds stop too.

The useful question is not "does the user win or do we keep everything?" It is "which processing must stop, which data must survive, and what is the smallest defensible reason for keeping it?" That framing usually produces a better privacy outcome and a much less exciting audit.