The right to restrict processing allows individuals (data subjects) to ask for the restriction of the processing of their personal data. This right is often exercised as an alternative to the request for data deletion.
Since this right is not absolute, there are only certain situations in which the right to restrict processing applies, if:
• upon individuals’ request the data is confirmed to be inaccurate
• the processing is unlawful but the data subject does not want the data to be erased and requests restriction (which is different from the right to be erased)
• the organization no longer needs data for the original purpose, but the individual wants the data to be preserved for the purposes of a legal claim
• the organization is in the process of verifying data erasure request
From the operational point of view, Recital 67 of the GDPR provides some guidance for organizations explaining that methods which may be used include:
• temporarily moving the selected data to another processing system,
• making the selected personal data unavailable to users,
• temporarily removing published data from a website.
