Can a company refuse to tell me why it is using my data?
Under GDPR, "why" isn't optional information — it's one of the first things a company is legally required to tell you.
Under GDPR, no — this is one of the more specific and enforceable rights in the whole regulation. The "right to be informed" (Articles 13 and 14) requires companies to proactively tell you the purpose of processing your data and, critically, which of six specific legal bases they're relying on to do it. You can also ask for this directly at any time under Article 15. In the US, there's no single equivalent federal right, but California's CCPA requires businesses to disclose the categories and purposes of data collection at or before the point of collection.
The six legal bases a company has to name
GDPR doesn't just require a vague "we use your data to improve our services" — every specific use has to rest on one of six defined legal bases, and the company has to tell you which one applies:
| Legal basis | What it means |
|---|---|
| Consent | You actively agreed to this specific use — and you can withdraw that consent at any time |
| Contract | The processing is necessary to deliver something you signed up for (e.g. your shipping address to deliver an order) |
| Legal obligation | A law requires the company to process this data (e.g. tax records) |
| Vital interests | Necessary to protect someone's life (rare, mostly medical emergency contexts) |
| Public task | Necessary for a task carried out in the public interest (mostly applies to public authorities) |
| Legitimate interests | The company has a genuine business reason that doesn't override your rights — this is the most commonly invoked, and the most commonly challenged, basis |
"Legitimate interests" is where most disputes happen, because it requires the company to have actually weighed its own interest against your rights — a company can't just claim this basis for anything convenient.
What a valid answer actually looks like
If you ask a company under GDPR why it's using your data, a compliant response names the specific purpose (not a vague category) and the specific legal basis, per purpose — a company using your email for both order confirmations (contract) and marketing (consent or legitimate interests) has to be able to separate those out, not lump everything under one umbrella answer.
A non-answer: "We use your data to provide and improve our services."
A compliant answer: "Your billing address is processed under contract necessity to fulfil your order. Your browsing behavior on our site is processed under legitimate interests for product recommendations, which you can object to at any time."
What to do if you get a vague or no answer
- Submit a formal Article 15 subject access request in writing, specifically asking for the purposes and legal basis for each category of data processed.
- If the response is vague or generic, reply asking them to specify the legal basis per purpose — this is a specific, named right, not an optional courtesy.
- If they continue to refuse or stonewall, escalate to your national data protection authority (the ICO in the UK, or your country's equivalent in the EU).
- If the legal basis given is "legitimate interests" and it doesn't seem genuinely balanced against your rights, you can separately object under Article 21.
Related questions
Official sources
Got a vague answer about your data?
Use Kibbo's Privacy & Data tools to draft a formal request for the specific purpose and legal basis behind how your data is used.
Explore Privacy & Data tools →