1Methods by which to restrict the processing of personal data could include, inter alia, temporarily moving the selected data to another processing system, making the selected personal data unavailable to users, or temporarily removing published data from a website. 2In automated filing systems, the restriction of processing should in principle be ensured by technical means in such a manner that the personal data are not subject to further processing operations and cannot be changed. 3The fact that the processing of personal data is restricted should be clearly indicated in the system.
Title is an unofficial description, added for readability.
Pause the data, don’t delete it
Keep it, but stop using it. GDPR Recital 67 lists practical ways to restrict processing: move the data to another system, make them unavailable to users, or take them off a website for a while. In automated systems the restriction should be enforced technically, so the data can’t be processed further or changed, and the system should show clearly that they are restricted.
What restriction means in law
Article 4(3) defines restriction of processing as “the marking of stored personal data with the aim of limiting their processing in the future”. Article 18 sets out when a data subject can ask for it and what follows: once data are restricted, the controller may still store them, but any other processing needs the person’s consent or has to serve legal claims, the protection of another person’s rights, or an important public interest of the EU or a Member State (Art. 18(2)). The person must be told before the restriction is lifted (Art. 18(3)), and Article 19 requires the controller to pass the restriction on to each recipient of the data unless that is impossible or involves disproportionate effort.
Recital 67 is the practical part. Its first sentence gives three example methods. The second says that in automated systems the lock should be technical, not just a policy. The third says the restricted status should be visible in the system, which matches the “marking” in Article 4(3).
Restriction is often the alternative to deletion
Two of the four grounds exist because the person wants the data kept: when processing is unlawful but they oppose erasure, and when the controller no longer needs the data but they need them for a legal claim. Deleting on a routine schedule in those cases can defeat the right, as the ACVIL case shows.
The four triggers
| Ground | What Article 18(1) says about duration | Case law |
|---|---|---|
| (a) The person contests the data’s accuracy | “For a period enabling the controller to verify the accuracy” | Links to Art. 16 rectification |
| (b) Processing is unlawful, and the person asks for restriction instead of erasure | No period stated | CJEU C-60/22: a missing Art. 26 arrangement or Art. 30 record is not enough on its own |
| (c) The controller no longer needs the data, but the person needs them for legal claims | No period stated | AEPD, ACVIL; Conseil d’État, Biocodex |
| (d) The person has objected under Art. 21(1) | “Pending the verification” of whether the controller’s legitimate grounds override | – |
Whichever ground applies, Article 18(3) requires the controller to inform the person before lifting the restriction.
What this means in practice
No
Reply within the Article 12 deadlines, explaining why, and tell the person they can complain to the supervisory authority
Yes
Continue to the next step
If you run automated systems
Recital 67 expects the lock to be technical where the system is automated.
- Block both further processing and changes to the restricted records, as the recital’s second sentence describes.
- Make the restricted status visible to anyone who opens the record.
- Check that exports, sync jobs and processors respect the flag too, since Article 19 requires recipients to be told.
If data are deleted on a schedule
An automatic deletion cycle can defeat a restriction request if nobody stops it.
- A request to keep data for a legal claim can override your normal deletion cycle. ACVIL deleted CCTV footage after such a request and was fined under Article 18.
- Moving the data out of the automatic cycle into a separate, access-limited store is one of Recital 67’s methods. The Conseil d’État accepted an archive used only for litigation as restriction.
- Answer the request itself on time. ACVIL’s late, incorrect reply also led to an Article 15 fine.
Enforcement cases
These three decisions show a failure, a restriction done right, and the limits of the “unlawful processing” ground. Each has its own case study with a timeline.
| Case | Authority / court | Date | Outcome | Recital 67 issue |
|---|---|---|---|---|
| ACVIL Aparcamientos (Spain) | AEPD | Mar 2026 | €150.000 proposed; €90.000 paid after reductions | Footage deleted despite a request to keep it |
| Biocodex (France) | Conseil d’État | Jul 2023 | CNIL closure upheld; no infringement | Restriction by moving data to an archive |
| UZ v Bundesrepublik Deutschland (C-60/22) | CJEU | May 2023 | Preliminary ruling; no fine | What counts as “unlawful” under Art. 18(1)(b) |
All Recital 67 enforcement cases
Frequently asked questions
What does restriction of processing mean under the GDPR?
Article 4(3) defines it as marking stored personal data so that their processing is limited in future. Under Article 18(2), restricted data may only be stored, unless the data subject consents or the processing is for legal claims, protecting another person’s rights, or important public interest.
When can someone ask for restriction?
In four situations under Article 18(1): while accuracy is being checked, when processing is unlawful but the person prefers restriction to erasure, when the controller no longer needs the data but the person needs them for legal claims, and while an objection under Article 21(1) is being assessed.
Can a company delete data I asked it to keep for a court case?
Not if Article 18(1)(c) applies. Spain’s AEPD proposed a €75.000 fine under Article 18 against a car park operator that deleted CCTV footage a customer had asked it to preserve for court. The company acknowledged responsibility and paid a reduced amount.
Does moving data into an archive count as restriction?
It can. France’s Conseil d’État held that a company keeping an ex-employee’s data only in an archive, accessible solely to defend itself in their dispute, had already restricted it. Recital 67 names moving data to another processing system as one method.
If a controller has no record of processing, can I demand restriction?
Not on that ground alone. The CJEU held in C-60/22 that missing an Article 26 arrangement or an Article 30 record does not by itself make processing unlawful under Article 18(1)(b). Other remedies apply, such as a complaint to the supervisory authority.
Can your systems pause one person’s data without deleting it?
Restriction needs a flag that every system respects, a record of why it was applied, and a reminder to tell the person before it is lifted. Those are easier to show when rights requests are tracked in one place.
Related provisions
Sources & further reading
- Regulation (EU) 2016/679 (GDPR), Recital 67, Articles 4(3), 18 and 19: official text
- AEPD, procedure PS/00159/2025 (EXP202500616), ACVIL Aparcamientos (Spanish)
- Conseil d’État, 24 July 2023, n° 465229 (French)
- CJEU, Case C-60/22, UZ v Bundesrepublik Deutschland, judgment of 4 May 2023