Table of Contents
Article 18 of GDPR: Restriction of processing
Article 18 of GDPR lays out another important right of the data subjects.
In essence, further to this article, a person can request that a company restrict the processing of their personal data.
Right to restrict personal data processing (Article 18(1) GDPR)
In the following circumstances, a person has the right to request that a company restrict the processing of their personal information:
- During the period of time that the accuracy of the personal data is disputed and the company is looking into it (Article 18(1)(a) GDPR)
- When the processing of the personal data was not legal but the individual prefers to restrict the data processing than requesting the erasure of the data (Article 18(1)(b) GDPR)
- When the organization does not need the personal data but are required to restrict the processing as the person will exercise a legal claim or defence (Article 18(1)(c) GDPR)
- During the period of time that a person has objected to a company’s processing of their personal data and the organization is evaluating if their legitimate interests override the person’s interests (Article 18(1)(d) GDPR)
When data processing has been restricted (Article 18(2) GDPR)
When personal data is restricted as it falls under any of the conditions of Article 18(1), then the company must not process the personal data in any way except for storing it unless the individual has agreed to it.
The company may also process personal data if:
- It’s for the establishment, exercise or defence of a legal claim
- For the protection of the rights of another person
- For reasons of important public interest
When processing restriction is lifted (Article 18(3) GDPR)
If a person’s personal data processing was restricted based on Article 18(1), should the company want to lift the restriction, they have a duty to inform the individual in question.
Recitals applicable to Article 18 of GDPR
Relevant Recitals: 67
GDPR Regulation article-by-article overview
Read our comprehensive overview of the GDPR Regulation, article by article, where we summarize each of the 99 articles contained in GDPR to give you a complete understanding of its content.
Cited Legislation in Article 18 or relevant recitals
None
GDPR Text: Article 18 of GDPR and Relevant Recitals
GDPR Text Source: EUR-Lex
Official GDPR Text: General Data Protection Regulation
Official GDPR Title: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), corrected by Corrigendum, OJL 127, 23.5.2018, p. 2 ((EU) 2016/679)
