When You Can Request a Restriction on the Use of Your Data
Suppose an old loan inquiry contains a wrong income figure. You want it checked before anyone uses it again. Under the European Union’s General Data Protection Regulation (GDPR), the right to restrict processing may help in certain circumstances. We explain what that request means and how to frame it. First, GDPR coverage must actually apply to the organization and processing concerned; a reference to GDPR in a U.S. website’s policy does not establish that every visitor qualifies.
Four situations where restriction may apply
Article 18 of the GDPR allows an eligible person to request restriction in four defined situations. These are grounds for a specific request, rather than a general option to freeze every record a company holds. The GDPR rules on requests to restrict processing describe the applicable duties and conditions.
- Accuracy is contested. If you dispute a recorded figure, restriction may apply for the period needed to verify its accuracy. Identify the incorrect field and explain the discrepancy.
- Processing is unlawful, but you oppose erasure. You may want a record preserved while stopping its normal use, rather than asking for it to be deleted.
- The controller no longer needs the data, but you need it for a legal claim. A relevant transaction record may have evidential value in establishing, exercising or defending your rights.
- You have objected under Article 21(1). Restriction can apply while the controller checks whether its legitimate grounds override your objection.
These situations have limits. If you object to one use, restriction does not necessarily extend to every dataset or every recipient. A controller must examine the request against the specific information, legal basis and circumstances involved.
Restrict, erase or object?
The three rights can sound similar. Choose the request that matches what you want the organization to do with the data.
| Right | Purpose of the request |
|---|---|
| Restrict processing | Keep identified data but suspend most uses when an Article 18 ground applies. |
| Erase data | Seek deletion where Article 17 applies, subject to retention and other exceptions. |
| Object to processing | Challenge particular processing under Article 21; the effect depends on its legal basis and purpose. |
Restriction generally allows continued storage. Other processing may still be lawful with your consent, for legal claims, to protect another person’s rights, or for important public-interest reasons recognized by law. It is therefore inaccurate to describe a granted restriction as permanently disabling all uses of the information.
What to include when you write
We suggest a brief, specific request that explains what you are disputing or preserving. Before contacting us, review our privacy policy and the contact options published there. Do not assume that a dedicated self-service restriction button or data-protection officer exists unless we have identified one.
The following details make the request easier to understand:
- Enough information to identify your earlier inquiry, such as the email address used and an approximate date, without sending a bank password or full account number.
- The particular personal information involved, including the field or communication you want reviewed.
- The Article 18 ground you believe applies, with a short factual explanation of the problem.
- A secure reply method and, where useful, a request for confirmation of what processing will be restricted.
Keep a dated copy. The controller may request proportionate identity verification if necessary. If another organization independently controls your information, you may need to address that controller as well; a message to one website cannot automatically bind all other organizations.
What happens after the request?
Where the GDPR applies, the controller must respond without undue delay, generally within one month. Complex or numerous requests may justify up to two additional months, with notice within the initial month. If it refuses to act, it must explain why and inform the person of relevant complaint and judicial remedies. The guidance on individual data rights explains the controller’s responsibilities for responding and keeping track of requests.
When restriction is granted, the controller may need to notify recipients to whom it disclosed the information, subject to legal exceptions. It must also inform the person before lifting the restriction. Such duties are tied to applicable law and the actual data flow; we should never promise technical steps that have not been confirmed for a particular inquiry.
We encourage you to use the published contact details if you believe your information needs review. Describe the data and the reason for your request, while keeping sensitive financial credentials out of ordinary messages. A specific, well-supported question is easier to assess than a demand to halt all processing without identifying the relevant information. This guide is general information, not legal advice.