Restriction of processing
How to handle a request to restrict processing under UK GDPR Art 18: the four grounds, what restriction allows you to keep doing, and the duty to tell the person before lifting it.
- Applies to
- Any controller under the UK GDPR.
- Instruments
- UK GDPR
- Steps
- 8 steps, with a deadline calculator.
Deadline calculator
Other data subject rights request
Rectification, erasure, restriction, portability, objection and automated decision requests: one calendar month from receipt, extendable by two further months for complex or numerous requests. Same counting as subject access.
Basis: UK GDPR Art 12(3) and Art 12A. Bank holidays for 2025 to 2028, by the standard calendar rules. A calculator, not advice.
Mechanics
| Item | Position |
|---|---|
| Deadline | One calendar month from receipt |
| Extension | Two further months for complex or numerous requests, notified within the first month |
| Stop the clock | While reasonably waiting for identity or clarification (Art 12A) |
| Cost | Free; a reasonable fee or refusal only if manifestly unfounded or excessive |
| Effect | Storage only, unless consent, legal claims, protecting another person or important public interest |
| Before lifting | Tell the person before the restriction is lifted (Art 18(3)) |
Steps
-
Check the ground
Restriction applies where the person contests accuracy (for the time it takes to check); the processing is unlawful and they want restriction instead of erasure; you no longer need the data but they need it for legal claims; or they have objected under Art 21(1) pending your decision on overriding grounds.
See UK GDPR
-
Restrict in practice
Mark or move the data so it is not used: take it off live systems, block access or flag it clearly. Keep storing it.
See UK GDPR
-
Only process restricted data on a listed basis
While restricted, you may store the data, and process it only with consent, for legal claims, to protect another person's rights, or for important public interest reasons.
See UK GDPR
-
Tell recipients
Tell each recipient about the restriction unless impossible or disproportionate (Art 19).
See UK GDPR
-
Tell the person before lifting
Inform the person before the restriction is lifted (Art 18(3)).
See UK GDPR
-
Refuse only with reasons
If you do not act, tell the person within the deadline why, and that they can complain to you, then to the Information Commission, and seek a judicial remedy. Manifestly unfounded or excessive requests may be refused, but you must be able to show why.
See UK GDPR
-
Handle any complaint
A dissatisfied requester complains to you first under your s.164A process (complaints received from 2026-06-19), then to the Information Commission.
Checklists and tools for this procedure
Explainers
- What is the right to restrict processing?Restriction
Sources
- Primary UK GDPR (Regulation (EU) 2016/679 as it applies in the UK) legislation.gov.uk
- Primary UK GDPR Article 12 legislation.gov.uk
- Primary Data Protection Act 2018 (c. 12) legislation.gov.uk