Right to Restriction

Legal Framework

The right to restriction of processing is governed primarily by Article 18 GDPR, which grants data subjects the right to obtain restriction from the controller on four enumerated grounds: where accuracy is contested pending verification; where processing is unlawful but the data subject prefers restriction to erasure; where the controller no longer needs the data but the data subject requires it for legal claims; and where the data subject has objected under Article 21(1) pending verification of overriding legitimate grounds.

The GDPR defines restriction in functional terms:

Once restriction is granted, the controller's operational latitude narrows significantly. Under Article 18(2), restricted data may, with the exception of storage, only be processed with the data subject's consent, for the establishment, exercise or defence of legal claims, for the protection of another person's rights, or for important Union or Member State public interest. Article 18(3) imposes a notification duty: the controller must inform the data subject before lifting the restriction.

Article 15(1)(e) requires controllers to inform data subjects of the existence of the restriction right when responding to access requests. Article 58(2) empowers supervisory authorities to order controllers to comply with data subject requests, including restriction requests.

Key Developments

The CJEU has confirmed that the access right under Article 15 is instrumental — it exists to enable downstream rights including restriction:

The CJEU reaffirmed this linkage in CK v Magistrat der Stadt Wien, confirming that access and restriction operate as connected procedural rights.

National courts have seen restriction claims pursued alongside other data subject rights. In a Dutch district court case, a litigant simultaneously invoked Articles 15, 16, 17, and 18 against a dean processing his data in connection with a professional complaint, illustrating that restriction is often sought as part of a multi-right claim rather than as a standalone remedy.

Enforcement has followed. The AEPD (Spain) imposed a €90,000 fine in a case involving failure to properly handle restriction requests, and the Italian Garante imposed a €20,000 fine where a public authority failed to restrict data after a request.

Status of the Debate

This topic is contested in court. While the CJEU has established that the access right serves the restriction right, national courts diverge on the practical boundaries — particularly on how long restriction must last under Article 18(1)(a) while accuracy is verified, and on the scope of "storage" as the permitted residual activity under Article 18(2). No definitive CJEU ruling has resolved how narrowly to construe the permitted processing categories during restriction. The open question that would settle the debate is whether the CJEU or a supervisory authority will articulate a maximum duration for the accuracy-verification period and clarify whether routine technical backups constitute permissible "storage" during restriction.

Practical Guidance

• Implement a flagging mechanism: When a valid restriction request is received under Article 18(1), mark the relevant data in your systems to prevent all processing except storage, as required by Article 18(2).
• Verify which ground applies: Determine which of the four statutory grounds the request falls under before granting or refusing; each has distinct prerequisites and durations.
• Notify before lifting: Before removing any restriction, notify the data subject as required by Article 18(3); failure to do so is an independent infringement.
• Inform during access responses: When responding to access requests, explicitly mention the right to request restriction under Article 15(1)(e).
• Document the restriction lifecycle: Record the date of the request, the ground invoked, the scope of restricted data, and any subsequent processing conducted under the Article 18(2) exceptions.