The Right to Restrict Processing: Pausing How Your Data Is Used

What restriction actually means

The right to restrict processing is one of the rights the UK GDPR gives every individual. In plain terms, it lets you ask an organisation to put your personal data on hold — to keep it but stop using it — while a specific question about that data is worked out. It is a pause button, not a delete button.

It is set out in Article 18 of the UK GDPR. When a restriction applies, the organisation may continue to store your data, but it generally cannot use it for anything else without your consent. There are narrow exceptions: it can still use restricted data to establish, exercise or defend a legal claim, to protect someone else's rights, or for an important public interest reason.

Restriction is most useful as a holding measure. It buys time and keeps the data unchanged while a more permanent question — is this accurate, is this use lawful, do I still need it kept — is being answered. This is general information, not legal advice.

When you can ask for a restriction

The right is not open-ended; it applies in specific situations the UK GDPR sets out. Knowing which one fits your case helps you explain the request clearly and helps the organisation act on it.

In broad terms, you can ask for processing to be paused while another issue is checked or decided. A common pairing is with accuracy: if you have asked an organisation to correct data you believe is wrong, you can ask it to restrict use of that data until it has verified whether it is accurate. The pause protects you in the meantime.

Restriction also fits where you believe a use is unlawful but would rather pause it than have the data erased, where the organisation no longer needs the data but you need it kept for a legal claim of your own, or where you have objected to a use and are waiting to hear whether the organisation's reasons override your objection. In each case you keep control of whether to ask, and for which data.

• You contest the accuracy of the data — restriction holds it while accuracy is checked.
• You think a use is unlawful but prefer a pause to deletion.
• The organisation no longer needs the data, but you need it kept for a legal claim.
• You have objected to a use and are awaiting the organisation's decision on whether its grounds override yours.
• Restriction keeps the data unchanged; it does not, by itself, delete anything or fix a factual error.

How to ask for a restriction, step by step

You can ask in writing — a short, clear message is enough, and you do not need a special form. Keep a dated copy of what you send for your own records.

An organisation should respond without undue delay, normally within one month. If a restriction is lifted later — for example, once an accuracy check is finished — it must tell you before it resumes using the data, so you are never caught unaware.

Throughout, the decision is yours: which data to pause, and whether to ask at all. OSINTA can help you understand your own footprint and frame and route your own request, but the choice stays with you. If you are unhappy with how an organisation handles your request, you have the right to complain to the Information Commissioner's Office (ICO). This is general information, not legal advice.

• Identify the specific data and the reason a pause applies — for example, an accuracy check you have already requested.
• Write to the organisation's privacy contact, stating you are asking to restrict processing under the UK GDPR.
• Name the data and the situation, and keep a dated copy of your message.
• Wait for the organisation's response — normally within one month — confirming the restriction or explaining its position.
• If the restriction is later lifted, the organisation must notify you before it resumes using the data.

Frequently asked questions

Related terms

• GDPR (General Data Protection Regulation)
• Data Subject Access Request (DSAR)
• Personal data
• Right to erasure