Term
Right to restriction of processing
A data subject's GDPR right to have the controller temporarily only store the data and not use them further, for example while their accuracy or an objection is being checked. The data are not deleted but marked as restricted.
Updated
What it means
The right to restriction of processing is a data subject's right under the GDPR to have the controller temporarily only store their personal data and not use it further. The data are not deleted but marked as restricted and may be processed only with the person's consent or on grounds the GDPR expressly allows.
It applies in four situations: the person contests the accuracy of the data while the controller checks it; processing is unlawful but the person does not want erasure; the controller no longer needs the data but the person needs them for legal claims; or the person has objected and it is being assessed whether the controller's grounds override.
Restriction is a kind of freeze on the data. It complements the right to rectification and the right to object, protecting the person while those requests are handled from further use of potentially inaccurate or contested data.
How it works in practice
Technically, restriction can mean moving the data to a separate system, blocking user access, temporarily taking down published data or clearly flagging the record in a database. What matters is that the data are not used by mistake, for example in a marketing campaign or automated processing.
The controller must normally respond within one month and inform the person before lifting the restriction. If it previously disclosed the data to other recipients, it tells them about the restriction unless that is impossible or involves disproportionate effort.
A company should have an internal procedure for data subject requests that covers restriction too. In a CRM or accounting system, a flag that blocks further processing of a specific record without deleting it is helpful.
What to watch out for
Restriction does not excuse statutory obligations. Data needed for accounting or tax must still be retained, and the controller may process them to defend legal claims even while processing is otherwise restricted.
Backups and copies in other systems need attention too. If data are restricted in the main database but still used from a spreadsheet export, the controller breaches the person's right, even unintentionally.
Need the term explained on your own situation? Consulting from €55 / hour excl. VAT, depending on topic and complexity.