The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.


Your organisation has appropriate methods and procedures in place to restrict the processing of personal data if required.

Ways to meet our expectations:

  • Your organisation restricts personal data in a way appropriate for the type of processing and the system, for example temporarily moving the data to another system or removing it from a website.
  • If the personal data has been disclosed to others, your organisation contacts each recipient to tell them about the restriction, unless this is impossible or involves disproportionate effort.
  • If asked to, your organisation tells the data subject which third parties have received the personal data.

Can you answer yes to the following questions?

  • Would staff say you have effective processes in place to restrict personal data?

  • Would requesters say you gave them clear information about the steps you took?