At a glance
- Individuals have a right to ‘block’ or suppress processing of personal data.
- When processing is restricted, you are permitted to store the personal data, but not further process it.
- You can retain just enough information about the individual to ensure that the restriction is respected in future.
When does the right to restrict processing apply?
You will be required to restrict the processing of personal data in the following circumstances:
- Where an individual contests the accuracy of the personal data, you should restrict the processing until you have verified the accuracy of the personal data.
- Where an individual has objected to the processing (where it was necessary for the performance of a public interest task or purpose of legitimate interests), and you are considering whether your organisation’s legitimate grounds override those of the individual.
- When processing is unlawful and the individual opposes erasure and requests restriction instead.
- If you no longer need the personal data but the individual requires the data to establish, exercise or defend a legal claim.
You may need to review procedures to ensure you are able to determine where you may be required to restrict the processing of personal data.
If you have disclosed the personal data in question to others, you must contact each recipient and inform them of the restriction on the processing of the personal data - unless this proves impossible or involves disproportionate effort. If asked to, you must also inform the individuals about these recipients.
You must inform individuals when you decide to lift a restriction on processing.