Right to restriction of processing

When restriction of processing is possible

Someone may ask for restriction of processing in the following situations:

• the personal data are possibly incorrect;
• the data processing is unlawful;
• the data are no longer necessary;
• the person in question has objected to the data processing.

Data may be incorrect

Has someone indicated that an organisation uses incorrect data of this person? And asked the organisation to amend these data? Then the organisation is not allowed to use these data as long as the organisation has not checked whether the data are correct.

Data processing is unlawful

According to the privacy rules, an organisation is not allowed to process certain data of a person and therefore actually has to remove (erase) these data. However, that person does not want the organisation to remove the data, for example, because they want to request the data at a later time.

Data are no longer necessary

An organisation no longer needs someone's personal data for the purpose for which they were collected. And therefore actually has to remove these data. But this person does not want the organisation to remove the data, because they are still needed for a legal claim. For example, legal proceedings in which that person is involved.

Objected to the data processing

Does someone lodge an objection to the personal data processing with the organisation because of the specific situation of this person? Then the organisation will have to stop processing the data. Unless the organisation has very good reasons to continue processing the data, which outweigh the interests of this person. As long as it is not clear what carries more weight, the organisation is not allowed to use the data.

Asking for restriction of processing

Do you want an organisation to restrict processing of your personal data? Then ask the organisation to do so in writing, by email or letter. You can use the restriction of processing example letter of the Dutch Data Protection Authority for your request.

At Using your privacy rights, you can read about what to do if you want to ask for rectification. And what you can expect from the organisation then. For example: the organisation has to verify your identity first.

Response to a request

The organisation has to give a response to your request within 1 month.

• Does the organisation decide to restrict processing of your personal data? Then the organisation will have to do this as soon as possible. That is within 1 month at the latest.
• Does the organisation refuse your request? Then the organisation will have to let you know why. Read here what you can do if you do not agree with the refusal.
• Does the organisation not respond within 1 month? Read here what you can do if the organisation does not respond.

Informing other organisations

Did the organisation restrict processing of your personal data? And did the organisation pass on your personal data to other organisations in the past year? Then the organisation will have to inform these other organisations that the use of your data has been restricted. And that these other organisations therefore have to restrict the use of your data as well.

Do you want to know which organisations have been informed in this way? Then you can ask the organisation. The organisation is obliged to answer your question.

For organisations: right to restriction of processing in practice

Do you, as an organisation, receive a request for restriction of processing? Take a look at: For organisations: privacy rights in practice to see what you have to do to handle the request in accordance with the rules (among other things: verify the requester's identity, reply period).