Restriction lets you limit how data is used while a qualifying dispute is resolved.
The right to restriction under Article 18 is different from deletion. Restricted data can usually be stored, but active use is limited unless a permitted exception applies.
It is particularly useful where you dispute accuracy and want the organisation to stop relying on the disputed data while it verifies the facts, or where processing is unlawful but you need the data preserved rather than erased.
Key points
- Restriction applies only in specified circumstances.
- Accuracy disputes and objections can create temporary restriction rights while checks are made.
- The controller should mark/segregate data so further processing is actually restricted.
- Recipients may need to be told of the restriction.
When restriction can apply
- You contest accuracy while the controller verifies it.
- Processing is unlawful and you prefer restriction to erasure.
- The controller no longer needs the data but you need it for a legal claim.
- You object under Article 21 and the controller is deciding whether its grounds override yours.
What “restricted” means
The controller may store the data but generally should not otherwise process it unless you consent, processing is needed for legal claims, protection of another person’s rights or important public-interest grounds. Technical measures should prevent ordinary use.
Lifting a restriction
Where the restriction is temporary, the controller should tell you before lifting it. If it decides the disputed data is accurate or its grounds override your objection, ask for the reasoning.
In practice
- Use restriction where continued use could cause harm while accuracy is unresolved.
- Specify the record/system and processing you want restricted.
- Ask how the restriction is technically recorded.
What to do
A practical next-step plan
- Identify the Article 18 ground.
- Specify the data and processing.
- Request restriction in writing.
- Ask for confirmation and recipient notification where relevant.
- Challenge any lifting/refusal with reasons.
Common traps
Things that often confuse the issue
- Restriction does not erase a debt or legal obligation.
- It is not available simply because you dislike processing.
- Some processing can continue under the Article 18 exceptions.
Evidence worth keeping
Ask for notice before restriction is lifted.
The UK GDPR framework provides protection around lifting a restriction. In practical terms, ask the controller to tell you the outcome of the underlying accuracy/objection issue and give notice before ordinary processing resumes. Keep the request and acknowledgement in writing.
Useful wording.
“I contest the accuracy of [data] and request restriction of its processing while you verify it. Please continue to store the record as necessary, but do not use or disclose the disputed data for ordinary decision-making while the restriction applies. Please confirm when restriction is implemented and notify me before it is lifted.”
Say exactly what processing you want stopped.
Identify the disputed record, system or onward disclosure. For example, you may want a disputed address marker prevented from feeding eligibility decisions while accuracy is investigated, rather than demanding restriction of an entire customer account. Ask how the organisation has technically marked or isolated the data and whether relevant recipients will be informed where required.
Use restriction for one of the recognised situations, not as a universal freeze button.
- You contest accuracy and the controller is checking it.
- Processing is unlawful but you oppose erasure and want use restricted instead.
- The controller no longer needs the data, but you need it for a legal claim.
- You have objected to processing and the controller is deciding whether its legitimate grounds override yours.
State which situation applies. A bare instruction to “freeze all my data” is easier to reject than a request linked to the legal ground.
Restriction is a pause on ordinary use, not deletion.
Where the right applies, the organisation can generally store the personal data but should not otherwise process it except in the permitted circumstances. This can be valuable where immediate deletion is not appropriate but continuing use could prejudice you while a dispute is resolved.
Official sources
Check the rules behind this guide
ConsumerWise explains these materials in plain English. Check the current official source where a deadline, rule about what the body can deal with or legal requirement may have changed.