A data subject objects to processing that the controller bases on legitimate interests. What must the controller do?
Select an answer to reveal the explanation.
Short Explanation
An objection is not a suggestion box card you can ignore. When someone says stop processing under legitimate interests, you pause that use unless you can show stronger grounds that really override theirs—or you need the data for a legal claim. Assess it properly; do not autopilot.
Full Explanation
When a data subject objects to processing based on legitimate interests, the controller must stop that processing unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or that the processing is necessary for legal claims. Objection triggers an active assessment burden on the controller, not an automatic right to continue.
Automatically continuing because legitimate interests “always defeat” objections misstates the override test. Deleting the entire customer relationship without assessing the objection’s scope and grounds may over-correct and confuse objection with erasure. Requiring a court order before considering any objection invents a procedural barrier GDPR does not impose.
Exam caveat: objection to legitimate-interest processing → pause and balance (or stop), with a special absolute stop for direct marketing. Operational check: suppress the contested processing pending analysis, document compelling grounds if continuing, communicate the outcome, and separate marketing objections which require cessation. Organisations serving the public should treat objections as citizen voice, not as nuisances to be ignored until sued.