GDPR marketing objections in Cyprus: stop and suppress

Identify the Article 21 objection before choosing a response

Article 21 has different branches. A person can object, on grounds relating to their particular situation, to processing based on public task or legitimate interests under Article 21(1); that branch may require an assessment of compelling legitimate grounds. Direct marketing is different. Under Article 21(2), the person may object at any time to processing for that purpose, including profiling related to it. Article 21(3) then says the data must no longer be processed for that purpose. Do not send a marketing objector a legitimate-interests balancing test as the reason for continuing a campaign.

Classify the purpose rather than the label on the database. A product announcement to an identified prospect, a targeted promotional offer and a matched advertising audience can all involve processing for direct marketing. An invoice, security alert or genuine service message may have a separate purpose. A mixed message requires scrutiny: calling a sales promotion a 'service update' does not remove the promotional purpose. Record which channels and audiences use the person's data so the response reaches more than one newsletter list.

Withdrawal of consent, an unsubscribe click, an Article 21 objection and an erasure request can arrive in the same sentence, but they are not identical rights. Stop the relevant marketing promptly and separately assess any request to erase data. The GDPR objection rule does not itself decide whether a promotional email was lawful to send initially. In Cyprus, Article 106 of Law 112(I)/2004 and the Commissioner's direct-marketing guidance govern the electronic-communications layer. Check that layer separately; an Article 6 GDPR lawful basis alone does not permit every email or SMS campaign.

For the separate deletion decision, see the GDPR erasure-request workflow.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 12, 17, 21 and 28; European Commission: Dealing with requests from individuals; European Commission: Legal grounds for processing data; Directive 2002/58/EC, including Article 13 on unsolicited communications; Cyprus Commissioner for Personal Data Protection: 2023 guidance on direct marketing; Cyprus Law 112(I)/2004, Article 106 on unsolicited communications

Recognise objections in every channel where they arrive

The person does not need to cite Article 21 or use a legal form. 'Stop sending offers', 'do not profile me for ads' and an unsubscribe action are practical signals that a marketing preference has changed. Train support, sales and social-media staff to route those signals to the same controlled process. A reply to an automated email or a request made in a call can be missed if the privacy team watches only a web form. Keep a dated record of the person's words and the channel in which they were received.

Work out the scope without imposing unnecessary friction. A person might reject one newsletter, all email promotions, all direct marketing or only profiling for targeted ads. Honour the clear part immediately. If the scope is genuinely unclear, pause the affected marketing while asking a short clarification; do not demand a detailed explanation for a direct-marketing objection. Make a reasonable link between the request and the identifiers in each system, such as an email address, phone number or customer ID. Do not request a passport simply to stop emails where control of the address and existing account details suffice.

Assign an owner for requests that arrive through agencies, processors and outsourced call centres. Record the case number, received time, identifiers, apparent scope and systems to update. A suppression event should travel to marketing operations without sharing the full complaint with every salesperson. The European Data Protection Board's small-business guidance is explicit that a person objecting to marketing does not have to give reasons. An intake script that asks 'why do you object?' before stopping use adds an avoidable barrier.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 12, 17, 21 and 28; European Data Protection Board: Respect individuals' rights; European Commission: Dealing with requests from individuals

Stop the relevant processing throughout the marketing stack

A successful objection is a purpose-level stop, not merely removal from one email tool. Map the flow from lead capture to CRM, segmentation, outbound email, SMS, sales sequences, advertising audience uploads and reporting. Mark the record before the next campaign export; cancel scheduled messages where the system permits. A campaign already queued in a second tool is a common failure point. Test the actual integration and its timing rather than assuming that one CRM checkbox is propagated everywhere.

Related profiling also falls within Article 21(2). If the team scores the person, predicts interests or places their details in a custom advertising audience for direct marketing, stop that use as well. Revisit active audience uploads and downstream partner instructions. An aggregate report that no longer identifies a person may raise a different issue, but do not relabel an identifiable ad audience as anonymous simply because its members are not visible to the campaign manager. Document what was disabled and what deletion or exclusion action the recipient platform offers.

Separate marketing data from data needed for another lawful purpose. A customer may still have an order history needed for fulfilment, accounting or a dispute after marketing stops. Apply purpose-specific access and use controls: sales staff should not use the retained invoice address to restart promotions. The objection does not automatically erase every copy of the person's data, and it does not authorise continuing marketing on a different Article 6 basis. If there is a separate erasure request, assess it on its own terms and explain any data retained for other purposes.

For a system-by-system retention inventory, use the GDPR retention-schedule guide.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 12, 17, 21 and 28; European Commission: Dealing with requests from individuals; European Data Protection Board: Respect individuals' rights

Use a narrow suppression record to prevent re-contact

Simply deleting the prospect from today's mailing list can allow tomorrow's imported list to add the same person again. A suppression record can prevent that outcome if it is confined to honouring the objection. Keep the minimum identifier needed to match future records, the relevant channel or purpose restriction, and the date and source of the request. Do not retain the old profile, interests and campaign history inside a supposedly narrow do-not-contact table. Limit access, define retention and record the lawful basis for this compliance activity rather than using the suppression record as a new marketing asset.

Build matching rules around the real identifiers you use. An email suppression entry should be applied before an email import or send; a phone objection needs the appropriate phone matching route. If a person objects to all direct marketing, a system that stores only 'email unsubscribe' will be too narrow. Conversely, an opt-out from one carefully identified newsletter should not silently change unrelated choices without considering the words used. When you cannot confidently link two records, review the case rather than merging unrelated people's identities.

A marketing suppression list is a control, not a source of leads. Do not enrich it, build lookalike audiences from it or use it to infer who may be persuaded to return. The minimum record should be checked against new imports before campaigns launch. Test that deletion from the operational CRM does not remove the suppression control, and that a merger or vendor migration carries it forward safely. If the person later asks for erasure of all data, explain why any minimal suppression identifier is still needed to honour their do-not-contact instruction.

The separate conditions and exceptions for erasure are set out in the Cyprus GDPR erasure guide.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 12, 17, 21 and 28; European Commission: Dealing with requests from individuals

Send the stop signal to processors and control new lists

Your controller's instruction has to reach the vendors and staff that run its marketing. Identify which email provider, CRM integrator, campaign agency and outsourced sales team receives personal data on your behalf. Give each relevant processor a precise stop instruction and a way to confirm execution; keep the instruction in the case record. Article 28 processor arrangements should support this operational exchange. If another organisation controls its own marketing purpose, assess that relationship separately rather than assuming a processor command will control an independent controller.

Newly purchased, scraped or transferred lists can reintroduce a person who already objected. Before importing a list, check both its lawful provenance and your own suppression controls. A vendor's statement that a list is 'GDPR compliant' does not prove that this controller can use it for a particular channel or that the person has not objected to this controller. The European Commission specifically warns that acquired contact lists require proof of lawful collection and permitted advertising use; email communication rules must also be met. Retain the contractual and technical evidence actually relied on.

Where a campaign has been shared with an advertising or analytics provider, inspect the platform's suppression and audience-removal mechanics. Do not promise the person that every downstream copy disappeared if the platform only stops future audience refreshes. Record the instruction, resulting status and any residual processing you cannot independently verify, then handle it through the applicable controller or processor relationship. A monthly reconciliation of suppression counts across tools can catch silent sync failures before the next promotion reaches the person.

See also the processor-agreement checklist when a vendor acts on your instructions.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 12, 17, 21 and 28; European Commission: Legal grounds for processing data; European Commission: Can data received from a third party be used for marketing?; European Commission: Dealing with requests from individuals

Make the right visible and respond in a way the person can verify

Article 21(4) requires the right to object to be brought explicitly to the person's attention, clearly and separately from other information, at the latest at the time of the first communication. Check the first promotional contact, signup journey and privacy information, not only the footer of a long policy. The contact should offer a practical route to object. If a link fails on mobile or requires account creation, the formal wording alone will not make the right easy to exercise. Test the route after an address has been deactivated or an account closed.

Under Article 12, communicate action on a rights request without undue delay and generally within one month of receipt; the Regulation provides a conditional extension for complex or numerous requests, with notice within the first month. That response period is not permission to keep sending marketing for a month after a clear objection. A short acknowledgement can say which contact details and channels are being suppressed, when the change took effect and how to report another unwanted contact. Avoid asking the person to resubscribe just to check whether the stop worked.

If the person disputes the response, give the route to the Cyprus Commissioner for Personal Data Protection and any applicable remedy information. The Commissioner's site distinguishes complaints about rights from complaints about unsolicited electronic communications; use the category that fits the issue rather than treating every spam report as an erasure case. Save a copy of the final response and the system confirmations. A record of a promise to unsubscribe, without evidence that tools and vendors were updated, is weak evidence of actual compliance.

Where a request covers more than marketing, the access-request guide describes a different rights workflow.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 12, 17, 21 and 28; European Commission: Dealing with requests from individuals; Cyprus Commissioner for Personal Data Protection: Lodge a complaint

Audit the failure points that produce repeat marketing

Test with a controlled address and phone number. Submit an objection through each public channel, including an email reply and a call-centre script, then inspect the CRM, email platform, advertising audience and campaign export. Verify that the next scheduled send excludes the person and that a subsequent import does not restore marketing status. Repeat the test after a vendor integration change. A successful click on an unsubscribe link proves only that a front-end event occurred; it does not show that every downstream system applied it.

Review records that move between brands or group companies. If the same legal controller operates several campaigns, define how a broad objection reaches them. If separate controllers share data, document who received the request and what each may need to do. Do not tell a person that a sister company has stopped processing unless you know that the instruction reached the relevant controller and was applied. Preserve the precise scope of the person's words so a later team does not reinterpret a broad objection as a narrow email preference.

Investigate every repeat message as a process defect: identify its source list, campaign owner, send time, suppression match, and any delay in synchronization. Correct the control and respond to the person with facts, rather than simply apologising and adding another ad hoc block. Periodic sampling should cover near matches, old lists, renewed consent claims and manual sales outreach. A suppression control has failed if it blocks the newsletter but leaves the person in direct messages and ad targeting for the same purpose.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 12, 17, 21 and 28; European Data Protection Board: Respect individuals' rights; European Commission: Legal grounds for processing data

Put a testable objection procedure into production

Start with a data-flow diagram of every channel used for direct marketing and its source of contact details. List the controller, processor, export schedule, audience destination and person who can stop a campaign. Write a short intake rule for support and sales, with an escalation route when identity or scope is genuinely uncertain. Make clear that an Article 21(2) objection stops marketing use without a balancing exercise. Keep the permission-to-send analysis for electronic communications as a separate checkpoint, because it answers a different legal question.

Next, configure one controlled suppression event with a clear purpose and minimal identifiers. Confirm that it reaches each tool, prevents re-import and can survive a CRM migration. Use a small set of test identities and keep screenshots or logs of the state before and after. Prepare a response template that states what stopped, what limited data remains and who to contact if further marketing arrives. Review the template against the actual system behaviour; do not promise instantaneous removal from a third-party platform unless the platform confirms it.

Finally, assign periodic ownership. Someone must review failed sync jobs, vendor changes, new acquisition channels and complaints about repeat contact. Track the number of objections, time to stop, downstream confirmations and recurrence after imports; these are operational quality measures, not a marketing conversion funnel. Recheck the legal position when EU or Cyprus electronic-communications rules change, but keep the Article 21 objection path working today. The strongest control is one that stops a real campaign and can show when and where that happened.

Basis and guidance: Regulation (EU) 2016/679, GDPR, Articles 12, 17, 21 and 28; European Commission: Dealing with requests from individuals; European Commission: Legal grounds for processing data; Directive 2002/58/EC, including Article 13 on unsolicited communications; Cyprus Commissioner for Personal Data Protection: Lodge a complaint

Primary sources and scope

Sources checked: October 7, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Regulation (EU) 2016/679, GDPR, Articles 12, 17, 21 and 28
• European Commission: Dealing with requests from individuals
• European Commission: Legal grounds for processing data
• European Commission: Can data received from a third party be used for marketing?
• European Data Protection Board: Respect individuals' rights
• Directive 2002/58/EC, including Article 13 on unsolicited communications
• Cyprus Commissioner for Personal Data Protection: 2023 guidance on direct marketing
• Cyprus Law 112(I)/2004, Article 106 on unsolicited communications
• Cyprus Commissioner for Personal Data Protection: Lodge a complaint