Skip to main content
Privacy Track
Category: Lawful Basis for Processing

Compelling Legitimate Grounds

Simply put

Compelling legitimate grounds are the strong reasons an organisation may need to show in order to keep processing someone's personal data after that person has objected to the processing. If the organisation can demonstrate these grounds outweigh the individual's interests, rights and freedoms, it may generally continue the processing despite the objection. This term arises in the context of the right to object and is not precisely defined in the GDPR itself.

Formal definition

"Compelling legitimate grounds" is a threshold referenced in the right to object (Article 21 GDPR / UK GDPR) where personal data is processed on the basis of legitimate interests (or the public task basis). Where a data subject exercises the right to object, the controller must cease processing unless it can demonstrate either compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or that the processing is for the establishment, exercise or defence of legal claims. The notion is not defined in the GDPR; per the EDPB Guidelines 1/2024 and ICO guidance, it is understood from the wording of Article 21 as requiring a strong justification that is assessed on the facts of each case, and the burden of demonstrating such grounds rests on the controller. It should be distinguished from the balancing test conducted when initially relying on legitimate interests under Article 6(1)(f): here the controller must actively demonstrate grounds that override the objecting individual, rather than the individual having to show their interests prevail. The precise content of what qualifies remains subject to assessment and evolving guidance, and readers should verify the current position against the official text and applicable regulator guidance, noting possible divergence between EU and UK approaches.

Why it matters

The right to object under Article 21 GDPR / UK GDPR shifts the burden of justification onto the organisation in a way that many other rights do not. When an individual objects to processing based on legitimate interests or the public task basis, the default position is that the controller must stop. Processing may generally continue only where the controller can actively demonstrate compelling legitimate grounds that override the individual's interests, rights and freedoms, or that the processing is for the establishment, exercise or defence of legal claims. Getting this threshold wrong exposes an organisation to a rights infringement, because continuing to process without a defensible justification can amount to unlawful processing.

The practical significance lies in the reversal of the balancing exercise. When first relying on legitimate interests under Article 6(1)(f), the balance is assessed at the outset. Once a valid objection is received, the controller must go further and show a strong justification that outweighs the specific objecting individual, taking account of their particular circumstances. This is a higher bar than the initial legitimate interests assessment, and the EDPB and ICO both make clear that the notion is not defined in the GDPR and must be assessed on the facts of each case. Organisations that treat an objection as a routine formality, or that rely on the same generic justification used at the outset, risk being unable to meet this threshold if challenged.

Because the content of what qualifies as compelling remains subject to assessment and evolving guidance, and because EU and UK approaches may diverge, organisations should document their reasoning carefully and verify the current position against the official text and applicable regulator guidance rather than assuming a fixed answer.

Who it's relevant to

Data Protection Officers and Privacy Leads
DPOs and privacy leads need to build processes for handling objections that recognise the burden falls on the organisation. They should ensure that any decision to continue processing after an objection is supported by a documented, case-specific justification that addresses the particular individual's interests, rights and freedoms, rather than a generic restatement of the original legitimate interests assessment.
Lawyers and Compliance Advisers
Legal and compliance advisers assessing objection responses should distinguish the compelling legitimate grounds threshold from the Article 6(1)(f) balancing test, and advise clients that the term is not defined in the GDPR and is assessed on the facts. They should also flag the alternative ground of establishment, exercise or defence of legal claims, and note possible divergence between EU and UK approaches when advising cross-border operations.
Engineers and Product Teams
Teams building systems that process personal data on a legitimate interests or public task basis should design workflows capable of halting processing in response to an objection, while allowing continued processing only where a documented justification has been recorded. This supports the organisation's ability to demonstrate its reasoning if the threshold is later challenged.
Organisations Relying on Legitimate Interests
Any controller relying on the legitimate interests basis (or the public task basis) is exposed to objections under Article 21 and should understand that continuing processing after an objection generally requires demonstrating compelling legitimate grounds that override the individual. Relying on this basis therefore carries an ongoing obligation to be able to justify processing at the point of objection, not just at the outset.

Inside Compelling Legitimate Grounds

Context in the right to object
The phrase 'compelling legitimate grounds' appears in Article 21 GDPR in connection with the data subject's right to object to processing based on legitimate interests (Article 6(1)(f)) or public task (Article 6(1)(e)). Where a data subject objects, the controller must generally cease processing unless it can demonstrate compelling legitimate grounds.
Controller's evidential burden
The burden lies on the controller to demonstrate the compelling grounds, rather than on the data subject to justify the objection. This is a demonstrable-accountability obligation and typically requires a documented assessment.
The overriding threshold
The grounds must override the interests, rights, and freedoms of the data subject. The term 'compelling' signals a higher, more demanding standard than the ordinary balancing test used to establish legitimate interests in the first place; a mere business interest is generally insufficient.
Legal claims exception
Alternatively to compelling legitimate grounds, processing may continue where it is necessary for the establishment, exercise, or defence of legal claims, which Article 21 treats as a distinct route from the compelling-grounds test.
Relationship to direct marketing
The compelling-grounds analysis does not apply to objections to processing for direct marketing purposes. In that context the right to object is generally absolute and the controller must stop the marketing processing, so this concept is out of scope there.

Common questions

Answers to the questions practitioners most commonly ask about Compelling Legitimate Grounds.

Does a data subject's objection under the right to object automatically require the controller to stop processing?
No. Where the controller relies on legitimate interests or public task, an objection under Article 21(1) does not automatically end the processing. The controller may continue if it can demonstrate compelling legitimate grounds that override the interests, rights, and freedoms of the data subject, or where the processing is for the establishment, exercise, or defence of legal claims. The burden generally sits with the controller to demonstrate those grounds, and the outcome is subject to assessment on the specific facts. Note this differs from an objection to direct marketing under Article 21(2)-(3), where processing must generally cease without such a balancing.
Is showing 'compelling legitimate grounds' the same test as the original legitimate interests balancing test?
Not exactly. The two are related but distinct. The legitimate interests basis under Article 6(1)(f) involves a balancing exercise carried out before or during processing to establish lawfulness. 'Compelling legitimate grounds' is the higher threshold a controller must meet after a data subject has objected, in order to continue processing over the objection. The word 'compelling' generally signals a more demanding standard than the initial assessment, though the precise weight is context dependent and subject to regulator guidance and case law rather than a fixed formula in the Regulation text.
What should a controller document to be able to rely on compelling legitimate grounds if challenged?
Controllers typically document the specific interests being pursued, why those interests are considered to override the data subject's particular circumstances, and the assessment weighing the two. In most cases this builds on the existing legitimate interests assessment but addresses the individual's objection and any specific factors they have raised. Maintaining a dated, reasoned record supports the accountability principle. The adequacy of any given record is subject to assessment, and you should verify expectations against current regulator guidance.
How quickly must a controller respond once a data subject objects?
An objection engages the controller's obligation to respond within the general timeframe applicable to data subject rights requests, and processing of the objected-to data may need to pause pending the assessment in some circumstances. Because timing rules and the practicalities of suspending processing can vary with the situation and national implementing law, the controller should confirm the applicable deadline and any extension conditions against the current official text rather than assume a fixed period.
Can compelling legitimate grounds be relied on for special category data?
The compelling legitimate grounds concept relates to overriding an objection where processing rests on legitimate interests or public task. Special category data under Article 9 requires an additional condition beyond an Article 6 basis, and legitimate interests is not itself listed as an Article 9 condition. Where special category data is involved, the controller must separately satisfy an applicable Article 9 condition, and continuing to process over an objection is subject to that additional requirement as well as the overriding-grounds assessment.
How does relying on 'establishment, exercise or defence of legal claims' differ from demonstrating compelling legitimate grounds?
These are presented as distinct routes for continuing processing after an objection. Demonstrating compelling legitimate grounds requires a reasoned assessment showing the controller's grounds override the data subject's interests, rights, and freedoms. The legal claims route allows continued processing where it is necessary for the establishment, exercise, or defence of legal claims, without the same overriding-grounds balancing. Which route applies depends on the actual purpose of the processing, and reliance on either should be assessed and documented on the specific facts.

Common misconceptions

Compelling legitimate grounds are the same as the legitimate interests that justified the processing initially.
They are distinct and set a higher bar. Establishing a valid legitimate interest under Article 6(1)(f) is a threshold to begin processing, whereas maintaining processing after an objection requires grounds that are compelling and that override the data subject's interests, rights, and freedoms. Relying on the original balancing test alone will generally not be sufficient.
If a controller can invoke compelling legitimate grounds, the data subject's objection can always be ignored.
The controller must be able to demonstrate those grounds through a documented, case-specific assessment, and the outcome is context and risk dependent. The concept does not create a blanket entitlement to continue, and it does not apply at all to direct marketing objections, where the right to object is generally absolute.
The right to object and its compelling-grounds test apply to every lawful basis.
The Article 21 right to object attaches principally to processing based on legitimate interests or public task. It is not a universal override for all Article 6 bases, and other rights or conditions may apply where processing rests on consent, contract, legal obligation, or vital interests. Practitioners should confirm the applicable basis before relying on this analysis.

Best practices

Treat the compelling-grounds assessment as separate from and more demanding than the original legitimate interests balancing test, and document why the grounds are compelling in the specific case rather than restating generic business interests.
Maintain a clear procedure for handling objections that suspends or reviews the relevant processing promptly while the assessment is carried out, given that the burden of demonstrating compelling grounds rests on the controller.
Distinguish objections to direct marketing, where processing should generally stop without a compelling-grounds analysis, from objections to legitimate-interests or public-task processing, and route them accordingly.
Consider whether the alternative route of necessity for the establishment, exercise, or defence of legal claims applies before relying on the compelling-grounds test, as these are distinct justifications.
Record each objection, the assessment reasoning, and the outcome to support accountability, and ensure decision-makers can articulate how the grounds override the data subject's interests, rights, and freedoms.
Verify the applicable legal basis and confirm current requirements against the official GDPR text and relevant regulator guidance, noting that positions may vary under UK GDPR and national implementing law.