Right to Restriction of Processing under Article 18 GDPR
What is the Right to Restriction of Processing?
The Right to Restriction of Processing is laid out in Article 18 of the General Data Protection Regulation (GDPR). It allows data subjects to request that their personal data not be further processed temporarily under certain conditions. The data may still be stored but may not be used otherwise during this time.
When Can Processing Be Restricted?
Restriction of processing can be requested in the following situations:
- The accuracy of the data is contested – for the period needed to verify it
- The processing is unlawful, but the data subject opposes erasure
- The controller no longer needs the data, but the data subject requires them for legal claims
- An objection has been lodged under Article 21(1) – pending verification of legitimate grounds
While restricted, data may only be processed with consent or for legal claims. It functions as a "pause" in processing, not a deletion.
Technical Implementation
Restriction can be implemented technically using flags, access controls, or internal system markings.
The controller must ensure that no further processing takes place beyond storage.
Controller Obligations
Under Article 19 GDPR, the controller must inform all recipients of the restriction, where feasible.
The data subject must be informed in advance if the restriction is lifted.
How Can Data Subjects Exercise the Right?
The request can be made in writing, electronically, or orally. The data subject must be clearly identifiable.
The controller must respond within one month. This may be extended by up to two months in exceptional cases.
The response must be provided in a transparent, clear, and accessible form in accordance with Article 12(1) GDPR.
