Right to restriction of processing

What it is

The right to restriction of processing is the right to obtain from the controller the temporary suspension of the processing of your personal data, without the data being erased.

The data is “frozen”: it stays in the database, but it cannot be used (except in specific cases).

A metaphor: it is like locking the data in a drawer. It is there, nobody touches it, but it cannot be used until the matter is resolved.

How it differs from other rights

• Restriction: the data is kept but not used (a temporary measure).
• Erasure: the data is deleted for good.
• Objection: you object to the processing, but the controller may continue if it has overriding legitimate grounds.

The 4 cases in which you can request it (Art. 18.1 GDPR)

1. While the accuracy of contested data is checked (Art. 18.1.a)

The scenario: you have contested the accuracy of your data (a rectification request, Art. 16) and the controller has to check whether it really is wrong. While it checks, you request restriction.

Practical example: you contest a €5,000 debt reported to a credit bureau, claiming you have already paid it. While the bank checks your receipts (which can take weeks), you request restriction: the record stays in the database, but it cannot be used to refuse you credit.

Duration: until the controller has verified the accuracy of the data.

2. Unlawful processing, but you do not want erasure (Art. 18.1.b)

The scenario: the processing is unlawful (it breaches the GDPR), but you would rather not have the data erased, because you may need it as evidence, and you just want them to stop using it.

Practical example: a company processed your data without any legal basis (no consent, no contract). Instead of requesting full erasure, which would deprive you of evidence for a possible compensation claim, you request restriction: the data stays, but it can no longer be used.

Duration: indefinite, until you settle the dispute or request erasure.

3. The controller no longer needs the data, but you need it for your defence (Art. 18.1.c)

The scenario: the controller no longer needs the data for its purposes (it would normally have to erase it, Art. 17), but you still need it to:

• establish a legal claim;
• exercise a legal claim;
• defend yourself in court.

Practical example: you closed your bank account five years ago. The bank would like to erase the data, which it no longer needs, but you have a civil lawsuit against the same bank over unauthorised charges and you need the statements as evidence. You request restriction: the bank keeps the data but cannot use it for other purposes (for example profiling or marketing).

Duration: for as long as you need it (for example until a final judgment).

4. While your objection to the processing is assessed (Art. 18.1.d)

The scenario: you have objected to the processing (Art. 21.1 GDPR) on grounds relating to your situation. The controller is checking whether it has overriding legitimate grounds to continue. While it checks, you request restriction.

Practical example: a company uses your data for marketing profiling on the basis of “legitimate interest” (Art. 6.1.f). You object (Art. 21) and the company must assess whether its interest overrides your reasons. Meanwhile you request restriction: the data cannot be used for marketing until the assessment is complete.

Duration: until the decision on the balancing of interests.