Right to Object

GDPR Article 21 gives data subjects a general right to object to processing based on legitimate interests or public interest, and an absolute right to object to processing for direct marketing. The controller must stop the objected-to processing unless it can demonstrate compelling legitimate grounds that override the subject's interests, rights and freedoms, or that the processing is necessary for the establishment, exercise or defence of legal claims. For direct marketing there is no override — the objection is final.

The DPDP Act does not create a standalone right-to-object: the Data Principal withdraws consent (Section 6(4)) instead, which has substantively the same effect for consent-based processing but no mechanism to interrupt legitimate-use processing. The PDPA's withdrawal right works similarly. US state laws (CCPA/CPRA and successors) give an opt-out of sale/share and of targeted advertising that performs the equivalent function for the US patchwork. The practical workflow — one-click unsubscribe, suppression lists, opt-out signal honouring — is the same across regimes.