Voice AI and the Right to Object: Article 21 Guide

A caller does not have to know the phrase "Article 21" to exercise it. "Stop calling me." "I do not want you keeping recordings of me." "Take me off your list." Each of those sentences, spoken to a voice agent, can be a legal objection to processing, and the clock and the duties that follow are not optional. For an enterprise running an AI voice channel across thousands of calls a day, the right to object is one of the most operationally demanding data subject rights, because it can land mid-conversation, it can be absolute, and it has to be honoured everywhere the caller's data lives.

The Information Commissioner's Office received 42,315 data protection complaints in 2024/25, up from 39,721 the year before, so the volume of people testing their rights is rising, not falling. Getting an objection wrong is not a paperwork slip: breaches of the data subject rights in Articles 12 to 22 sit in the upper tier of Article 83(5), carrying a maximum penalty of 17.5 million pounds or 4% of global annual turnover.

This guide is shipped by the team behind Dilr Voice, enterprise voice AI built for regulated deployments. Or see DATS, our five-stage AI consulting system.

What is the right to object under Article 21?

The right to object under Article 21 of the UK GDPR lets a data subject tell a controller to stop processing their personal data. It is not one right but two: an absolute right to object to direct marketing, which you honour at once, and a qualified right to object to legitimate-interest or public-task processing, which you continue only on a high bar. Dilr Voice has to recognise which one a caller is raising.

That two-part shape is what makes Article 21 harder to operationalise than it first appears. A right-to-erasure request or a subject access request has a single well-known pathway. An objection forks immediately: the purpose the caller is objecting to decides whether you stop, or whether you get to weigh it. Enforcement pressure on rights handling is real and rising, as the ICO's own complaint numbers show.

Why does an objection flip the burden onto the controller?

Because Article 21 moves the onus of proof. Before you process, you build the case for a lawful basis yourself. Once a caller objects, the default reverses: you must stop unless you can actively demonstrate a reason strong enough to override them. Under Article 21(1), the controller may keep processing only by showing compelling legitimate grounds that override the person's interests, rights and freedoms. That burden now sits with you, on the record.

This is the point most teams miss, and it is the reason an objection is not the same conversation as a legitimate interests balancing test. Your original balancing assessment asked whether your interest was legitimate and proportionate in the ordinary case. The post-objection test is a different, harder question: is your ground compelling enough to override this specific person who has actively said no? "Compelling" is a higher standard than "legitimate", and the burden of showing it has shifted onto you. Dilr Voice treats the objection as a state change on the record, not a note in a call summary.

What must you do when a caller objects to a marketing call?

Stop, with no test to apply. Where processing is for direct marketing, Article 21(2) gives the caller an absolute right to object, and Article 21(3) removes any discretion. There is no compelling-grounds weighing, no reason you can offer to keep marketing to them. The moment the objection is registered, marketing of that person's data, including related profiling, must cease. On an outbound voice campaign, the number comes off the calling list at once.

The regulation is blunt on this point. Article 21(3) of the UK GDPR states:

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Keep this separate from the telephone marketing rules in PECR. The Privacy and Electronic Communications Regulations govern whether you could make the marketing call at all, through consent and the Telephone Preference Service, and our guide to outbound calling under GDPR and PECR covers that regime. Article 21 is the parallel UK GDPR right that lets an individual switch off marketing to them personally. Under the Data (Use and Access) Act 2025, the maximum PECR penalty rose from 500,000 pounds to the UK GDPR ceiling of 17.5 million pounds or 4% of turnover from 5 February 2026, so the marketing-objection surface is now expensive on both statutes.

How do you handle an objection to legitimate-interest processing?

Here you get to weigh it, but the weighing is demanding. When a caller objects to processing based on legitimate interests, recognised legitimate interests, or a public task, you may continue only if you can demonstrate compelling legitimate grounds that override their interests, rights and freedoms, or that you need it to establish or defend legal claims. If you cannot show that, you stop. While you assess, default to caution and document the reasoning.

What makes the compelling-grounds test different from your original assessment is the evidence it demands. A workable AI execution office acceptance test is simple: for each processing purpose that relies on legitimate interests, can you write down, in advance, the specific grounds you would rely on if a caller objected, and would they survive scrutiny against one named individual's rights? If the honest answer is that you would struggle, the objection should default to a stop. Recording the reasoning at the moment of decision is what turns a defensible position into an auditable one.

How long do you have to respond to an objection?

Two clocks run, and confusing them is the classic error. The duty to tell the caller what you have done runs to one month. Article 12 of the UK GDPR requires you to act on a rights request under Articles 15 to 22D, which covers an Article 21 objection, without undue delay and within the applicable time period. The Data (Use and Access) Act 2025 moved that period into the new Article 12A and set it at one month.

The one-month window is the deadline for telling the caller the outcome. It is not permission to keep marketing to them for a month. That month can be extended by up to two further months for genuinely complex requests, and paused where you reasonably need to confirm identity, but the marketing stop itself is never deferred. For a direct-marketing objection under Article 21(3), the processing must cease straight away; the one-month clock only governs when you must confirm the action back to the person. Treat them as separate obligations. A voice AI platform should log the objection with a timestamp so the response deadline is measurable, while the marketing suppression itself takes effect on the same call. Building the wrong single deadline into your process is how firms end up making compliant-looking calls that are already unlawful.

How do you suppress an objection across every system?

An objection is only honoured when the last system holding the data has been told. The mid-call moment, where a caller says stop, is only the trigger; our guide to consent withdrawal mid-call covers that live handover. What Article 21 then demands is a suppression lifecycle that reaches every downstream store, because an objection sitting in the call transcript but not pushed to the dialler is not compliance, it is a liability with a timestamp.

Map the surfaces the objection has to touch. The outbound dialler and campaign lists have to drop the number so no further marketing call is queued. The CRM record, whether Salesforce or HubSpot, needs a suppression flag that later imports and lookalike builds respect, not a free-text note a workflow will overwrite. The consent and preferences store has to record the objection as the current state. Any vendor or sub-processor holding a copy of the calling list has to receive the update, because your obligation follows the data, not your own database boundary. Dilr Voice writes the objection to a single source of truth so these systems read one consistent state.

Closing an objection needs evidence, not a tidy status. The record should show when the objection was captured, which purposes it covered, when each system was suppressed, and, for a legitimate-interest objection, the compelling-grounds reasoning and the final decision. That evidence trail is what you would show the ICO, and it is the difference between a defensible outcome and an unverifiable claim that you handled it.

The same acceptance-test logic runs through our AI operating model consulting, where rights handling is designed as a governed workflow rather than bolted on after launch.

How is objecting different from withdrawing consent or erasure?

They are separate rights, and a voice AI platform has to route each correctly. Withdrawing consent under Article 7 only applies where consent was your lawful basis, and it stops future processing without erasing what came before. Objecting under Article 21 applies to legitimate-interest, public-task and direct-marketing processing, and for marketing it is absolute. Neither is the same as asking you to delete data. Confusing them can breach the very right the caller invoked.

The cleanest way to see the boundary is by what each right leaves behind. A right to erasure request asks you to remove the data. A right to rectification request asks you to correct it. An Article 21 objection asks you to stop processing it for a purpose, which may leave the record in place but frozen for that use. And where consent was the basis, a withdrawal under Article 7 is often the more natural route than an objection. Your agent's job is to identify what the caller is actually asking for and record it as the right they invoked, because accuracy in routing rights is a compliance control in its own right.

What is the best way to handle Article 21 objections in a voice AI deployment in 2026?

There is no single best tool. The honest verdict: a small, single-system operation can meet Article 21 with a well-drilled manual process against one CRM, and a generic voice platform will not slow it down. General-purpose builders such as Vapi, Retell AI and Synthflow can capture an objection, and PolyAI is a credible enterprise option. But capturing the intent is the easy part; the hard part is cross-system suppression and the evidence trail, where most deployments fail.

For a regulated enterprise with an objection that must propagate across a dialler, a CRM, a consent store and one or more sub-processors, the decisive criterion is not whether the agent can hear "stop", but whether the platform can prove it stopped everywhere and confirm within the one-month window. That is the ground Dilr Voice is built for, and where our delivery approach starts: mapping every rights route and every downstream store before a single production call is made. Read our fuller UK and EU voice AI compliance guide for the wider rights picture, and the compliance blog for the neighbouring duties.

Does the Data (Use and Access) Act 2025 change the right to object?

Only at the edges, and in a way that widens it. The Data (Use and Access) Act 2025 amended Article 21(1) from 5 February 2026 to insert a reference to point (ea) of Article 6(1), so the right to object now expressly covers processing under the new recognised legitimate interests basis. The absolute direct-marketing right in Article 21(2) and (3) was left unchanged. In practice, the recognised-legitimate-interests route the DUAA created remains objectable.

Can a caller object to an AI making a decision about them?

That is a related but separate right. Article 21 objects to processing for a purpose. A decision made solely by automated means, with legal or similarly significant effects, is governed instead by the automated decision-making rules the DUAA reshaped into Articles 22A to 22D. A caller unhappy that an AI is calling or profiling them uses Article 21; a caller unhappy that an AI decided something about them engages the ADM regime. A voice AI deployment should route both.

Want to see this in production? Try Dilr Voice live, book an AI placement diagnostic, see our DATS methodology, or read about our approach to placing AI inside enterprise systems.

Written by the Dilr.ai engineering team, practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.