Restriction of processing

Restriction of processing is a data subject right under Article 18 GDPR. A data subject may request it while the accuracy of personal data is being verified, where processing is unlawful but the data subject prefers restriction to erasure, where the controller no longer needs the data but the data subject requires them for legal claims, or while an objection under Article 21(1) GDPR is being assessed.

During the restriction, the data may generally be stored but not otherwise processed. Further processing is permitted only with the data subject’s consent, for the establishment, exercise or defence of legal claims, to protect the rights of another person, or for an important public interest of the European Union or a Member State. Before lifting the restriction, the controller must inform the data subject and must generally communicate the restriction to recipients that received the data.

For businesses, the request should be recorded, the affected data and systems identified, and the restriction communicated to everyone who needs to follow it. The overview of data subject rights and access explains the wider process. The access request checklist supports structured handling, while privacy compliance and governance helps organise responsibilities.