Article 18 of the GDPR: Right to restriction of processing
Article 18 of the GDPR explained
The data subject may obtain restriction of processing when:
- It challenges the accuracy of the data (during verification);
- The processing is unlawful but it prevents the erasure of the data;
- The person responsible no longer needs the data but they are still necessary for the person to establish, exercise or defend legal rights;
- She objected to the processing (article 21) and a verification of legitimate grounds is underway.
During this limitation, the data cannot be than preserved, and not otherwise processed without consent or legal necessity.
Why is this article important for your GDPR compliance?
This right protects people in cases of litigation, uncertainty or legal need. It supplements the rights of access, rectification and opposition. Lack of knowledge can lead to excessive or premature processing of sensitive data.
How to comply with Article 18 of the GDPR?
- Set one up clear mechanism for managing limitation requests.
- Label or isolate the affected data in your systems to avoid automatic processing.
- Inform the persons concerned of the lifting or maintenance of the limitation.
- Document each request in your processing log.
Examples of application of Article 18 of the GDPR
- A user disputes the accuracy of a bank statement: the bank suspends the use of the data during verification.
- A company keeps HR data necessary for industrial tribunal litigation, but limits it to this legal use.
- A customer objects to marketing processing: their data is put on hold until the decision.
Related Resources
Accelerate your compliance in just a few clicks
With our all-in-one solution, you can accelerate and ensure compliance easily:
- Automate your compliance with our GDPR software
- Supported or outsourced by our DPO experts
- Raise awareness among your teams with our GDPR training e-learning
👉 Request a demo with an expert
⚡ Assess your situation in 15 minutes with our free, no-obligation GDPR self-diagnosis.
