Right to Restriction

Legal Framework

Article 18 GDPR grants data subjects the right to restrict — rather than fully erase — the processing of their personal data. This intermediate remedy applies across four specific scenarios under Article 18(1): (a) where the data subject contests the accuracy of the data, pending the controller's verification; (b) where the processing is unlawful and the data subject opts for restriction instead of erasure; (c) where the controller no longer needs the data for its original purpose but the data subject requires it for the establishment, exercise, or defence of legal claims; and (d) where the data subject has objected under Article 21(1) pending verification of whether the controller's legitimate grounds override the data subject's interests.

When restriction is activated, the controller may — with limited exceptions — only store the data. All other processing activities are suspended unless the data subject consents, the data is needed for legal claims, or processing serves the rights of other natural or legal persons, or important public interest reasons under Article 18(2).

Article 19 imposes a cascading notification obligation: the controller must communicate any restriction of processing to each recipient to whom the personal data were disclosed, unless this proves impossible or involves disproportionate effort. Upon the data subject's request, the controller must also identify those recipients.

Key Developments

The Court of Justice of the European Union has situated the right to restriction within the broader architecture of data subject rights. In Österreichische Datenschutzbehörde v CRIF, the Court confirmed that the right of access under Article 15 serves as a necessary precondition enabling data subjects to exercise downstream rights — including the right to restriction under Article 18. This establishes a practical interdependence: without effective access, restriction claims cannot meaningfully be formulated.

In Sergejs Buivids v. Augstākā Tiesa, the Court confirmed that video recordings stored on a hard disk drive constitute automatic processing of personal data, meaning such data falls squarely within the scope of Article 18's protections. Similarly, in Smaranda Bara et al. v. CNAS, the Court treated data transfers between public authorities as processing operations, confirming that restriction rights attach to data at each stage of the processing chain — including onward transfers to downstream recipients.

These rulings collectively establish that restriction obligations attach broadly to any operation involving personal data, and that controllers must be prepared to propagate restriction requests across their entire disclosure chain.

Practical Guidance

• Implement a restriction mechanism in processing systems. Article 18(2) permits only storage when restriction is active. Ensure technical configurations can flag restricted records and block further processing — including automated decision-making, profiling, or onward transfers — without deleting the data.

• Maintain a recipient log for Article 19 compliance. The notification obligation requires controllers to identify all recipients of restricted data. Without an accurate disclosure trail, demonstrating compliance becomes impossible, and data subject requests for recipient information cannot be fulfilled.

• Apply a disproportionate-effort test with caution. Article 19 allows exemption from notification where it proves impossible or involves disproportionate effort, but this threshold is high and must be documented with a reasoned assessment — not assumed.

• Train intake teams on the four Article 18(1) triggers. Restriction requests often arrive informally or are bundled with rectification, erasure, or objection requests. Staff must recognize when restriction — rather than full erasure — is the appropriate remedy and process accordingly.

• Coordinate restriction with parallel rights. As confirmed in CRIF, restriction frequently follows an access request or accompanies an objection under Article 21. Ensure workflows connect these rights so that restriction is applied automatically where applicable, rather than requiring a separate request.