In short. A visitor has a right to restriction under GDPR Article 18 for disputed accuracy, unlawful processing, legal claims or a pending Article 21(1) objection assessment.
Definition: Restriction of processing means marking stored personal data, information relating to an identified or identifiable person, to limit its future processing. Article 18 of the General Data Protection Regulation (GDPR) gives individuals a right to restriction when one of four specified grounds applies.
Key facts
- Under GDPR Article 18(2), restricted data can remain in storage; other processing is limited to specified circumstances.
- As of 17 October 2026, the European Data Protection Board's small business guide recommends keeping records of rights requests and responses.
- Ireland's Data Protection Commission uses its Self-Assessment Checklist to ask whether controls and procedures can halt processing when someone validly requests restriction under Article 18.
Which grounds give a visitor this right?
The controller is the party deciding the purposes and means of processing. A website operator acting as controller must restrict processing when any of the following grounds in Article 18(1) applies:
- Disputed accuracy: the visitor contests the accuracy of their personal data. Restriction covers the period needed for the controller to verify accuracy.
- Unlawful processing: processing is unlawful, and the visitor opposes erasure and requests restriction of use instead.
- Legal claims: the controller no longer needs the data for its processing purposes, but the visitor requires it to establish, exercise or defend legal claims.
- An objection awaiting assessment: the visitor objects under Article 21(1), and verification is pending on whether the controller's legitimate grounds override the visitor's grounds.
How must the website handle restricted data?
Article 18(2) permits storage. Other processing requires the person's consent, a purpose connected with establishing, exercising or defending legal claims, protection of another natural or legal person's rights, or reasons of important public interest of the Union or a Member State.
Recital 67 gives implementation examples: temporarily moving selected data to another processing system, making it unavailable to users, or temporarily removing published data from a website. For automated filing systems, it describes technical measures preventing further processing and changes, with the restriction clearly indicated in the system.
Article 19 requires the controller to communicate the restriction to each recipient to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort. The controller must identify those recipients to the person on request. Under Article 18(3), the controller must inform the person before lifting the restriction.
What response must the visitor receive?
Under Article 12(3), the controller must provide information on action taken without undue delay and within one month of receiving the request. An extension of two further months is possible where necessary, considering the complexity and number of requests. The controller must explain the extension and its reasons within the initial month.
The EDPB guide recommends preparing request procedures and training staff. It gives an online form as an example of facilitating rights electronically. Article 12(4) requires a controller taking no action to explain why without delay and within one month, and to explain the possibility of a supervisory authority complaint and a judicial remedy.
Related terms
- GDPR right to rectification
- GDPR right to object
- How long does a website have to answer a GDPR rights request?
- Must a website notify recipients when personal data is corrected?
FAQ
Can I ask for restriction while an inaccurate record is checked?
Yes. Article 18(1)(a) gives you this right for a period enabling the controller to verify the accuracy of your personal data.
Can the website charge me for a restriction request?
Article 12(5) makes rights requests free of charge. For a manifestly unfounded or excessive request, the controller may charge a reasonable administrative fee or refuse to act, and bears the burden of demonstrating that character.
Can the website ask me to confirm my identity?
Under Article 12(6), reasonable doubts about your identity permit a request for additional information necessary to confirm it.
Sources
- EUR-Lex, "General Data Protection Regulation", 27 April 2016
- European Data Protection Board, "Respect individuals’ rights", undated
- Data Protection Commission, "Self-Assessment Checklist", undated
Check how a page reads to answer engines. Open the GEO score analyzer