Fiche 36/54 Part 4 — Data Subject Rights Intermediate Reviewed 2026-08-23

Right to Restriction of Processing (Art. 18)

Article 18 allows individuals to freeze the processing of their data. The controller retains the personal data in segregated storage, but cannot actively use it, acting as a temporary bridge during di

Open in interactive reader

⚖️ Data Freezing Mechanism 📋 4 Statutory Triggers (Art. 18.1)

Right to Restriction of Processing (Art. 18)

⚡ In 30 seconds

Under Article 18, data subjects have the right to obtain from the controller the restriction of processing. The data remains stored, but except for storage, can only be processed with the individual's consent, for legal claims, or to protect the rights of another person. Restriction acts as an essential safeguard while disputes are being investigated.

Trigger Case (Art. 18.1)	Operational Context	Freezing Scope
(a) Accuracy Contested	Data accuracy is disputed by the individual.	Frozen for a period enabling the controller to verify accuracy.
(b) Unlawful Processing	Processing is unlawful, but user opposes erasure.	User prefers data preservation (e.g. to prove an unlawful action).
(c) Legal Claims Need	Controller no longer needs data, but user requires it.	Preserved for the establishment, exercise or defence of legal claims.
(d) Pending Objection	User objected under Art. 21(1) based on legitimate interests.	Frozen pending verification whether controller's grounds override.

⚡ Key Takeaways

Downstream notice: the controller must notify recipients of any restriction under Article 19.
Marking restricted data: restricted records must be clearly flagged in database architectures (Recital 67).
Advance notification: the user must be formally warned before the restriction is lifted (Art. 18.3).

⚠️ Common Pitfall

Unfreezing restricted records and resuming automated marketing before notifying the individual in writing.

🛠️ In Practice

Create a `status: restricted` boolean flag in user tables that suppresses records from active application queries.

⚖️ Official Sources: Art. 18 & 19 GDPR · Recital 67 ✓ Legal review: 23 August 2026