GDPR Article 23: Limitations on Data Subject Rights

· By Bertrand BucelleBertrand Bucelle · 2 min read

GDPR Article 23: Limitations on Data Subject Rights

Article 23 of the GDPR Explained

The rights provided for in Articles 12 to 22 (and Article 34) may be subject to limitations by law, provided that these restrictions:

  • Respect the essence of fundamental freedoms and rights;
  • Constitute a necessary and proportionate measure in a democratic society.

Among the legitimate objectives that may justify these limitations:

  • National security, defence, public safety;
  • Prevention, investigation, detection or prosecution of criminal offences;
  • Other important objectives of general public interest (economy, public health, etc.).

Why is this article important for your GDPR compliance?

This article introduces essential flexibility to reconcile data protection with public interest requirements. It justifies certain cases where a data controller may temporarily restrict the rights of data subjects if authorised by law.

How to Comply with Article 23 of the GDPR?

  • Identify whether your activity or processing operations benefit from a legal exemption provided for by national or European law.
  • Keep available legal documentation justifying the applied restriction.
  • Transparently inform data subjects when their rights are restricted (unless specifically prohibited).
  • Keep a record of decisions made on this basis.

Application Examples of GDPR Article 23

  • A judicial authority restricts an individual's right of access in the context of a criminal investigation.
  • An emergency health measure temporarily limits the right to object to certain processing of medical data.
  • A public operator restricts the erasure of data to comply with a legal obligation related to national security.

Related Resources

Accelerate Your Compliance in a Few Clicks

Thanks to our all-in-one solution, you can accelerate and ensure your compliance easily:

  • Automate your compliance with our GDPR software
  • Supported or outsourced by our DPO experts
  • Raise your teams' awareness with our GDPR training e-learning

Request a demo with an expert

Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.

GDPR: Self-assess now