GDPR Article 18: Right to restriction of processing

· By Bertrand BucelleBertrand Bucelle · 2 min read

GDPR Article 18: Right to restriction of processing

Article 18 of the GDPR Explained

The data subject has the right to obtain restriction of processing when:

  • They contest the accuracy of the personal data (pending verification);
  • The processing is unlawful, but they oppose the erasure of the data;
  • The controller no longer needs the data, but they are still required by the data subject for the establishment, exercise or defence of legal claims;
  • They have objected to the processing (Article 21) and the verification of legitimate grounds is pending.

During this restriction, the data can only be stored, and not otherwise processed without consent or a legal necessity.

Why this article is important for your GDPR compliance

This right protects individuals in cases of dispute, uncertainty or legal need. It complements the rights of access, rectification and objection. Its disregard can lead to excessive or premature processing of sensitive data.

How to Comply with GDPR Article 18

  • Implement a clear mechanism for managing restriction requests.
  • Tag or isolate the relevant data in your systems to prevent any automatic processing.
  • Inform the data subjects of the lifting or continuation of the restriction.
  • Document each request in your record of processing activities.

Examples of GDPR Article 18 Application

  • A user disputes the accuracy of a bank statement: the bank suspends the processing of data pending verification.
  • A company retains HR data necessary for employment litigation, but restricts its use to this legal purpose.
  • A client objects to marketing processing: their data is suspended pending a decision.

Related Resources

Accelerate Your Compliance in a Few Clicks

With our all-in-one solution, you can easily accelerate and ensure your compliance:

  • Automate your compliance with our GDPR software
  • Supported or outsourced by our DPO experts
  • Raise your teams' awareness with our GDPR training e-learning

👉 Request a demo with an expert

⚡ Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.

👉 GDPR: Self-assess now