What is the right to restrict processing?
The right to restriction lets people ask you to stop using their data, other than storing it, while a dispute is resolved or where they need it kept for a legal claim. You must lift the restriction only after telling them.
What it is
Restriction freezes the data: you may keep it but not otherwise use it without the person's consent, except for legal claims, protecting another person's rights, or important public interest reasons.
When it applies
- The person contests accuracy, while you verify. UK GDPR Art 18(1)(a)
- The processing is unlawful but the person wants restriction rather than erasure. Art 18(1)(b)
- You no longer need the data but the person needs it for legal claims. Art 18(1)(c)
- The person has objected, while you consider whether your grounds override theirs. Art 18(1)(d)
Who is responsible
The controller, which must tell recipients and inform the person before lifting the restriction.
What it involves
- Mark or move the data so it is not used.
- Tell recipients.
- Resolve the underlying issue.
- Tell the person before lifting it.
Timing
One month, extendable by two.
If it goes wrong
- Regulatory
- Failing to respond properly breaches Arts 12 to 22. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change. Most cases start with a complaint to the regulator, which can order compliance.
- Criminal
- No offence.
- Civil
- The person can apply to court for a compliance order (DPA 2018 s.167) and claim compensation for damage or distress (Art 82; s.168).
Go further
- The law
- UK GDPR
- Procedures
- Restriction of processing
- Guides
- Erasure and restriction
More on people's rights
Sources
- Primary UK GDPR, Article 18 legislation.gov.uk
- Primary UK GDPR, Article 19 legislation.gov.uk
Updated