# Restrictions — GDPR — context bundle

> Focused context for a single provision, curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/laws/gdpr/art-23
> Every item cites its source. Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

## Provision

### Restrictions — Restrictions

*GDPR, gdpr-art-23-en — https://overview.legal/laws/gdpr/art-23*

1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
   a) national security;
   b) defence;
   c) public security;
   d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
   e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;
   f) the protection of judicial independence and judicial proceedings;
   g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
   h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
   i) the protection of the data subject or the rights and freedoms of others;
   j) the enforcement of civil law claims.

2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:
   a) the purposes of the processing or categories of processing;
   b) the categories of personal data;
   c) the scope of the restrictions introduced;
   d) the safeguards to prevent abuse or unlawful access or transfer;
   e) the specification of the controller or categories of controllers;
   f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
   g) the risks to the rights and freedoms of data subjects; and
   h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

## Enforcement

13 decision(s) on record cite Article 23, totalling approximately €8,219,000 in fines (median €8,000).

Top fines:
- **Vodafone España, S.A.U.: Insufficient fulfilment of data subjects rights** (SPAIN, €8,150,000) — https://overview.legal/posts/46709
- **Vamavi Phone S.L.: Insufficient fulfilment of data subjects rights** (SPAIN, €24,000) — https://overview.legal/posts/46664
- **Avilon Center 2016 S.L.: Insufficient fulfilment of data subjects rights** (SPAIN, €12,000) — https://overview.legal/posts/46682
- **TIGERS MARKET, S.L.: Insufficient fulfilment of data subjects rights** (SPAIN, €8,000) — https://overview.legal/posts/47288
- **ADSL HOUSE, S.L.: Insufficient fulfilment of data subjects rights** (SPAIN, €8,000) — https://overview.legal/posts/47583

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-23 · 2026-08-22