Right to Restrict Processing

What is the right to restrict processing under the GDPR?

Individuals have a right to restrict the ways in which their personal data is processed by an organisation (art 18 GDPR). This means that the data controller is either only allowed to hold their data or use it for specific restricted purposes.

When can a data subject request restriction of data processing under GDPR?

Companies are obliged to comply with requests to restrict data processing in the following circumstances:

• if the accuracy of the data is being contested
• if the processing of data is unlawful but the data subject opposes its erasure
• if a data subject has objected to the data processing but the data controller is considering whether it has legitimate grounds which overrides the objection
• if the data controller no longer needs the data but the individual requires it to establish, exercise or defend a legal claim

What is the notification obligation regarding restriction of data processing?

Any third parties which have received the personal data must be informed by the data controller of data processing restriction requests (art 19 GDPR).

How can we help you comply with the GDPR?

We provide a GDPR Audit to help businesses understand their data protection obligations under the GDPR and check their compliance with the rules.