This is a new right provided for in Article 18.
The data subject can restrict the processing of their personal data when:
- the accuracy of the data is contested (for a period to enable the controller verify the accuracy)
- the processing is unlawful and the data subject objects to the erasure of the data and requests restrictions of their use instead
- the controller no longer requires the data for their purposes but the data subject require them for the establishment, exercise or defence of legal claims
- the data subject has objected to processing based on the grounds of legitimate interests or tasks carried out in the public interest under official authority, pending verification (i.e. Article 21(1) applies)
Methods of restricting the processing of data are suggested in Recital 67.
Apart from storage, no processing of the particular data can occur without the consent of the data subject unless it is in connection with legal claims, protection of rights of another person, or in important public interests of the Union or Member State.
Before lifting the restriction on processing, the controller must inform the data subject.
If the controller has disclosed the personal data, Article 19 applies and the controller must advise each recipient of the data in question about the restriction on processing and, if requested, the controller must inform the data subject about those recipients.