Right to restriction of processing

The right to restriction of processing is enshrined in Article 18 of the General Data Protection Regulation (GDPR). This right allows data subjects to request that their personal data not be actively processed (e.g., not processed, transferred, modified, or deleted) but only stored.

It can be considered a “temporary suspension” of processing, often used while a concern regarding the lawfulness of processing or data accuracy is clarified.

The situations in which a data subject can exercise the right to restrict processing include:

1. Inaccuracy of personal data
   When the data subject contests the accuracy of their personal data. In this case, the restriction will last for the time necessary to verify the accuracy of the data.
2. Unlawful processing
   When the data subject opposes the erasure of data processed unlawfully and prefers to request a restriction of its use.
3. Data no longer needed by the controller but needed by the data subject for legal purposes
   When the controller no longer needs the personal data for processing purposes, but the data subject needs it for the establishment, exercise, or defense of legal claims.
4. Objection to processing
   When the data subject has objected to processing based on legitimate interest, pending verification of whether the controller’s legitimate grounds override those of the data subject.

During the restriction period, personal data can only be processed for specific purposes, such as with the data subject’s consent, for the establishment or defence of legal claims, or for reasons of significant public interest. The controller must inform the data subject before lifting the restriction and resuming normal data processing.

Trust Guardian’s approach to the right to restriction of processing
Trust Guardian facilitates the management of the right to restriction of processing by centralizing data subjects’ requests in the Rights Management section. Through myPrivacy platform, data subjects can request restrictions on their data processing, and companies can monitor and track each request in compliance with GDPR provisions.