| name | restriction-of-processing |
| title | Handling Right to Restriction Requests |
| description | Handles GDPR Article 18 right to restriction of processing requests, covering the four grounds for restriction (accuracy contest, unlawful processing, erasure opposition, legitimate interest pending), technical flagging mechanisms, and lifting procedures. Activate for restriction request, Art. 18, processing freeze queries. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/restriction-of-processing |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Handling Right to Restriction Requests
Overview
The right to restriction of processing under GDPR Article 18 allows data subjects to request that a controller limits the processing of their personal data in specific circumstances. When restriction is applied, data may be stored but not otherwise processed without the data subject's consent or for limited specified purposes. This skill provides the complete workflow for assessing, implementing, and managing restriction requests.
Legal Foundation
GDPR Article 18 — Right to Restriction of Processing
Four Grounds for Restriction Under Art. 18(1)
- Art. 18(1)(a) — Accuracy contested: The data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data.
- Art. 18(1)(b) — Unlawful processing, erasure opposed: The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
- Art. 18(1)(c) — Erasure opposition for legal claims: The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defence of legal claims.
- Art. 18(1)(d) — Objection pending verification: The data subject has objected to processing under Art. 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
Processing Permitted During Restriction (Art. 18(2))
When processing has been restricted, the personal data may only be processed:
- With the data subject's consent, OR
- For the establishment, exercise, or defence of legal claims, OR
- For the protection of the rights of another natural or legal person, OR
- For reasons of important public interest of the Union or a Member State.
GDPR Article 19 — Notification Obligation
The controller must notify each recipient to whom the personal data have been disclosed of the restriction, unless this proves impossible or involves disproportionate effort.
Lifting the Restriction (Art. 18(3))
A data subject who has obtained restriction of processing shall be informed by the controller before the restriction of processing is lifted.
Restriction Processing Workflow
Step 1: Receive and Log the Request
- Log the request with reference RST-YYYY-NNNN.
- Record the channel, timestamp (UTC), and identity of the requester.
- Send acknowledgement within 3 business days.
