Handling Right to Restriction Requests

Overview

The right to restriction of processing under GDPR Article 18 allows data subjects to request that a controller limits the processing of their personal data in specific circumstances. When restriction is applied, data may be stored but not otherwise processed without the data subject's consent or for limited specified purposes. This skill provides the complete workflow for assessing, implementing, and managing restriction requests.

Legal Foundation

GDPR Article 18 — Right to Restriction of Processing

Four Grounds for Restriction Under Art. 18(1)

1. Art. 18(1)(a) — Accuracy contested: The data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data.
2. Art. 18(1)(b) — Unlawful processing, erasure opposed: The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
3. Art. 18(1)(c) — Erasure opposition for legal claims: The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defence of legal claims.
4. Art. 18(1)(d) — Objection pending verification: The data subject has objected to processing under Art. 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Processing Permitted During Restriction (Art. 18(2))