Right to Restriction of Processing

Standard form for exercising the right to restriction of processing (Catalan version available)

The data subject has the right to have his or her stored personal data marked, with the aim of restricting their processing in the future. Restriction of processing should not be confused with the blocking of data that currently exists in Spanish data protection legislation (LOPD).

Restriction of processing implies that, on the request of the data subject, his or her personal data should no longer be processed.  Restriction may be requested when: 

• The data subject has exercised the rights of rectification or objection and while the controller determines whether the request should be granted.
• The processing is unlawful, which would mean the personal data would be erased, but the data subject opposes such erasure.
• The personal data are no longer necessary for the purposes of the processing, which would result in their erasure, but erasure is opposed and restriction requested by the data subject because they are required for the establishment, exercise or defence of legal claims. 

Where the processing has been restricted, the controller may only process the affected data, with the exception of storage, in the following cases: 

• With the consent of the data subject.
• For the establishment, exercise or defence of legal claims.
• For the protection of the rights of another natural or legal person.
• For reasons of important public interest of the Union or of the corresponding Member State.

The controller should communicate the restriction to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller should inform the data subject about those recipients if the data subject so requests.