The right to restriction of processing is the data protection right, set out in Article 18 of the General Data Protection Regulation (GDPR), that allows an individual to require a controller to keep their personal data but limit its use, usually to storage only, while a disputed question is resolved. Among user rights in privacy law, it acts as a temporary freeze that sits between continued processing and permanent erasure.
Restriction protects people in situations where deletion would be premature or harmful and continued use would be unfair. A person who disputes the accuracy of their data, for example, may want it neither used nor destroyed until the correction is checked. Restriction preserves the data, stops its active use and keeps both sides’ positions intact.
When the right to restriction applies
The GDPR grants the right to restriction only on four specific grounds. A request outside these grounds can be refused, although a controller may still restrict data voluntarily. Each ground corresponds to a situation where the final outcome is not yet clear or where the person needs the data preserved.
| Ground | Typical situation | How long restriction lasts |
|---|---|---|
| Accuracy contested | The person says the data is wrong | Until the controller verifies accuracy |
| Unlawful processing, erasure opposed | Processing lacks a legal basis, but the person wants the data kept | As long as the person requires |
| Data needed for legal claims | The controller no longer needs the data, but the person does | Until the legal claim is settled |
| Objection pending | The person objected to processing based on legitimate interests or public task | Until the controller decides whether its grounds override |
Two of the grounds work as companions to other rights. Restriction during an accuracy dispute accompanies the right to rectification, and restriction pending an objection accompanies the right to object. The second ground gives people an alternative to the right to erasure when deleting data would destroy evidence they need.
What restriction means in practice
Once data is restricted, the controller may only store it. Any other processing is allowed solely on narrow exceptions: with the person’s consent, for the establishment, exercise or defense of legal claims, to protect the rights of another person, or for reasons of important public interest recognized in law.
The GDPR recitals describe practical methods of restriction, such as moving the data temporarily to a separate system, making it unavailable to users, or temporarily removing published data from a website. In automated systems, restriction must be ensured by technical means, and the fact that data is restricted should be clearly indicated in the system.
| Method | How it works | Best suited for |
|---|---|---|
| Restriction flag | A status field blocks use in all processing workflows | Customer databases and CRM systems |
| Access control change | Only a small authorized group can view the record | Shared internal systems |
| Segregated storage | Data moved to an isolated store until release | Records that are hard to flag |
| Suppression from outputs | Data excluded from mailings, analytics and exports | Marketing and reporting pipelines |
| Unpublishing | Public content temporarily taken offline | Websites and public directories |
Restriction compared with neighboring user rights
Restriction is easiest to understand when it is set against the other data subject rights. Each right changes the data or its use in a different way, and they are often exercised together.
| Right | Effect on the data | Permanence |
|---|---|---|
| Right to restriction of processing | Kept, but use is frozen | Temporary |
| Right to erasure | Deleted | Permanent |
| Right to rectification | Corrected or completed | Permanent change |
| Right to object | Processing for a specific purpose must stop if upheld | Permanent for that purpose |
| Consent withdrawal | Processing based on consent stops | Permanent until new consent |
Comparable concepts exist outside the GDPR. The UK GDPR contains the same right, and several other privacy laws include rights to limit certain uses, such as the right to limit use of sensitive personal information in California. These are narrower in purpose and should not be treated as identical to Article 18.
Obligations of controllers handling a request
A restriction request follows the general rules for data subject requests. The controller must respond without undue delay and within one month, a period that can be extended by two further months for complex or numerous requests, provided the person is told about the extension within the first month.
- Verify identity proportionately before acting, without demanding excessive documents.
- Apply the restriction across all systems, including backups in active use, processors and integrations.
- Notify recipients to whom the data was disclosed, unless this is impossible or involves disproportionate effort.
- Inform the person before lifting the restriction, so they can react in time.
- Document the decision, including the ground, the scope and the review date.
Restriction is often requested as part of a broader data subject access request or complaint, so privacy teams benefit from a single intake process that recognizes which rights a message actually invokes, even when the person does not name them.
Common mistakes and edge cases
Restriction is the least familiar of the GDPR rights, and organizations frequently handle it poorly. Typical errors arise from treating it as deletion or ignoring it in automated processes.
- Deleting data when restriction was requested, which can destroy evidence the person needs.
- Restricting only the main database while marketing tools or analytics still use copies.
- Keeping restrictions indefinitely after the dispute is resolved, without informing the person.
- Refusing because systems lack a flag, which does not excuse the legal obligation.
Systems designed with privacy by design include a processing status field from the start, which makes restriction a routine operation rather than a manual workaround.
Put simply
The right to restriction of processing lets a person say to an organization: keep my information, but do not use it for now. It is used while a disagreement is checked, or when the person needs the information preserved for a legal case.
It works like putting a file in a locked drawer. The file is not shredded, and nobody may work with it until the drawer is opened again, and the person must be told before that happens.
In practice
A customer of an online retailer notices that her account shows two unpaid orders she never placed and that the retailer is about to pass the debt to a collection agency. She contests the accuracy of the data and asks for the records to be restricted while the matter is investigated.
The retailer sets a restriction flag on the disputed orders, which blocks transfer to the collection agency and removes the account from payment reminders, while the records remain stored. The investigation shows that a third party used her details fraudulently. The retailer corrects the account, informs her before lifting the restriction and notifies the collection agency that the claim has been withdrawn.