# Standards and Regulatory References

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 21(1)** — Right to object to processing based on Art. 6(1)(e) or 6(1)(f)
- **Article 21(4)** — Obligation to inform data subjects of the right to object
- **Article 21(5)** — Automated exercise of objection right in information society services
- **Article 21(6)** — Objection to processing for research/statistical purposes
- **Article 17(1)(c)** — Right to erasure following a successful objection
- **Article 18(1)(d)** — Right to restriction pending compelling grounds assessment
- **Article 6(1)(e)** — Processing for public interest / official authority
- **Article 6(1)(f)** — Processing for legitimate interests
- **Recital 69** — Right to object: controller must demonstrate compelling legitimate grounds

### UK Data Protection Act 2018
- **Section 21** — Right to object (supplements Art. 21 in UK context)

## Regulatory Guidance

### European Data Protection Board (EDPB)
- **Guidelines 01/2022 on data subject rights — Right of access** (adopted 28 March 2023): Provides context on the relationship between access and objection rights.
- **Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC** (WP217): Provides the balancing test framework applicable to Art. 6(1)(f), which forms the basis for the "compelling legitimate grounds" assessment under Art. 21(1).

### Information Commissioner's Office (ICO) — United Kingdom
- **Right to object guidance** (updated 2024): Practical guidance on handling objections, conducting the compelling grounds assessment, and managing the relationship between objection and erasure.
- **Legitimate interests guidance** (updated 2024): Framework for the three-part legitimate interest assessment, relevant to the higher "compelling" standard under Art. 21(1).

## Technical Standards

### ISO/IEC 27701:2019 — Privacy Information Management
- **Section 7.3.5** — Objection by PII principals: establishes controls for processing objection requests within a PIMS framework.