The fifth right within data protection is the right to restrict processing. Very similar to last week’s right to erasure, people can ask to limit how their data will be processed.

Reasons to restrict processing

As part of Article 18 of the UK GDPR, people can ask to restrict the processing of their data if:

• You are considering a rectification request and checking the accuracy of their data,
• You are considering whether your legitimate interest overrides an objection request,
• The data was unlawfully processed, but the person doesn’t want their data to be erased, or
• You don’t need the data, but the person needs you to keep it to establish, exercise, or defend a legal claim.

Like all requests, it can be done verbally, online, or in writing, to any part of your organisation. You must first be certain of their identity, and that they can be asking for that person’s data.

You can also refuse the request if:

• It interferes with your freedom of expression and information,
• There is a legal obligation,
• There is overriding public interest,
• The request is manifestly unfounded or excessive,
• You are archiving the data for public interest, scientific research, historical research or statistical purposes, and erasing the data may seriously impair that purpose, or
• You need to establish, exercise, or defend legal claims.

What should I do?

If the restriction request is valid, you must respond as soon as possible, and within a month.

If the data was disclosed to a third party, you should also tell them about the request.

To restrict the data, you could temporarily move it to another processing system, make the data unavailable, or remove it from wherever it is published. You must ensure that it cannot be processed, but that you have not erased it.

In some cases, the restriction may be temporary. In that case, you must inform the person that you are lifting the restriction before you do so.

Impacts of restriction

While the data is restricted, you must not do anything but store it, unless:

• You have their consent,
• To establish, exercise, or defend legal claims,
• To protect the rights of someone else, or
• For public interest.

If you are restricting the data because you are considering another request, you can lift the restriction once you’ve made the decision on the other request.

If you need any more information regarding the right to restriction, potential exemptions, how to handle your data whilst it’s restricted, or other advice on dealing with data privacy rights, feel free to contact us.

Next week, we’ll be looking at your right to data portability.