Right to restriction of processing
is the GDPR's successor to the Directive's right to 'blocking' - a temporary freezing of data. On listed grounds (accuracy contested, unlawful processing where the subject wants restriction not erasure, controller no longer needs the data but the subject needs it for legal claims, or an objection is pending verification) the controller may store the data but not otherwise process it, except with consent or for legal claims, others' rights, or important public interest. Restriction is usually temporary; the controller must inform the individual before lifting it.
Article 18 lets data subjects restrict processing - a temporary freeze. The Directive had no direct restriction right but allowed 'blocking'. WP 251 says restriction can apply at any stage of processing.
| Ground | Note |
|---|---|
| Accuracy is contested | Only for as long as it takes to verify accuracy |
| Processing is unlawful | Subject wants restriction instead of erasure |
| Controller no longer needs the data | But the data subject needs it to establish/exercise/defend legal claims |
| Objection under Art 21(1) pending | While overriding grounds are being verified |
- While restricted, data may only be stored - not otherwise processed - unless: the subject consents; it is for legal claims; to protect another's rights; or for important public interest
- Recital 67 suggests moving data to another system, making it unavailable to users, or temporarily removing it from a website
- Restriction is usually temporary; before lifting it the controller must inform the individual and explain why (e.g. data verified accurate, or legitimate grounds override)