Right to restriction of processing

The right to restriction of processing is the right of the data subject to obtain from the controller the restriction of processing of their personal data in four situations set out in Art. 18(1) GDPR: where the accuracy of the data is contested, for a period enabling the controller to verify it; where the processing is unlawful but the data subject opposes erasure and requests restriction instead; where the controller no longer needs the data but the data subject requires them for the establishment, exercise or defence of legal claims; and where the data subject has objected under Art. 21(1), pending verification of whether the controller's legitimate grounds override those of the data subject.

While restricted, data may be stored but processed otherwise only with the data subject's consent, for legal claims, for the protection of the rights of another person, or for reasons of important public interest (Art. 18(2)). The controller must inform the data subject before lifting the restriction (Art. 18(3)) and notify recipients of the restriction (Art. 19). Recital 67 suggests implementation methods such as moving data to a separate system, making it unavailable to users or flagging it in the system.

In clinical research, restriction is often the appropriate outcome of a participant's request that cannot result in erasure because of Art. 58 CTR retention and GCP integrity requirements: the sponsor flags the record so it is excluded from further analyses and secondary use while remaining archived. Member State law implementing Art. 89(2) may limit the right where it would seriously impair research objectives. EDC, safety and data warehouse systems should be able to apply and log a restriction flag, and the procedure agreed between sponsor, investigator and CRO should specify who applies it and how the participant is informed.