The right of restriction (Article 18 of the GDPR)

You have a limited right of restriction of processing of your personal data by a data controller. Where processing of your data is restricted, it can be stored by the data controller, but most other processing actions, such as deletion, will require your permission.

How does this right apply?

This right applies in four ways. The first two types of restriction of processing apply where you have objected to processing of your data under Article 21, or where you have contested the accuracy of your data. In these cases, the restriction applies until the data controller has determined the accuracy of the data, or the outcome of your objection.

The third situation in which you can request restriction relates to processing which is unlawful. In these cases, if you do not want the data controller to delete your information, you can request restriction of the personal data instead.

The fourth type of restriction of processing applies where you require data for the purpose of a legal claim. In this case, you can request restriction even where the data controller no longer needs the data.
 

When you have obtained restriction of processing, what obligations does the data controller have?

Where you have obtained restriction of processing of your data, the data controller must inform you before lifting the restriction.