Article 18 GDPR : Restricting Processing Pending Verification of Rights

The Four Grounds for Restriction (Art. 18(1)) and Their Legal Effects (Art. 18(2)-(3))

The data subject has the right to obtain from the controller restriction of processing where one of the four statutory grounds of Article 18(1) applies: the accuracy of the personal data is contested (for a period enabling verification), the processing is unlawful but the data subject opposes erasure and requests restriction instead, the controller no longer needs the data but they are required for legal claims, or an objection has been lodged pursuant to Article 21(1) pending verification of whether legitimate grounds override those of the data subject.

During restriction, personal data shall — with the exception of storage — only be processed with the data subject's consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

• Technical flagging: restricted data must be clearly flagged as such across IT systems (dedicated database flag, status lock, segregated store);
• Lifting of restriction: the data subject must be formally informed before the restriction is lifted (Art. 18(3));
• Recipient notification duty: the controller communicates any restriction, rectification, or erasure to each recipient (Art. 19);
• Leverage effect: restriction frequently precedes rectification (during accuracy checks) or accompanies objection (temporary operational freeze).

For smaller organisations, operational implementation remains straightforward: flag relevant records in CRM/ERP systems, block any new processing (direct marketing, automated scoring, publishing), hold data securely during verification, and subsequently either rectify/erase or lift restriction following prior notification to the data subject.

Verified Official Sources

See Also in the Legal Framework