Right to Restrict Processing

A GDPR Article 18 data subject right enabling individuals to limit how organizations use their personal data while maintaining its storage. Processing restriction applies when: the individual contests data accuracy (during verification period), processing is unlawful but the individual prefers restriction over erasure, the controller no longer needs the data but the individual needs it for legal claims, or the individual has objected to processing pending verification of the controller's legitimate grounds. When processing is restricted, organizations can only: store the data, process it with the data subject's consent, process it for legal claims, protect another person's rights, or process for important public interest reasons. Organizations must inform the data subject before lifting restrictions and notify third parties who received the data about the restriction. This right provides a middle-ground option between continued processing and deletion, allowing individuals to pause processing while disputes are resolved or specific situations are addressed.