The right to restriction means that the individuals have the right to restrict the processing of their personal data in certain circumstances. This means that an individual can limit the way the controller can use their data in the following situations:
- Firstly, if the individual contests the accuracy of their personal data and the controller can verify the accuracy of the data;
- Secondly, if the data has been unlawfully processed and the individual opposes that the data is being erased and requests restriction instead;
- Third, if the personal data is no longer necessary for the controller but the individual needs that the controller keep it in order to establish, exercise or defend a legal claim; or
- Lastly, if the individual has objected to the processing of their data under Article 21(1), and the controller is considering if their legitimate grounds override the individuals.
The right to restriction is stated in article 18 GDPR.