Your right to restrict data processing

As explained in an earlier page of this website, the term processing means interacting with information in some way. It includes collection, use and storage.

Generally, you have the right to prevent an organisation from processing your data.

However, there are limitations. The organisation can continue to store your data, and process just enough to be able to identify that there is a restriction on processing the rest.

For example, it could store your name and e-mail address so that if you were to request that it provides you with a service, it could deny that request on the grounds that you previously didn’t agree to it providing it.

If you contact an organisation to tell it that the data held about you is incorrect, it must restrict processing until it has corrected the mistakes or confirmed that the data is accurate.

If the processing is unlawful (for example, you did not consent to the way it is used) or no longer necessary, you can ask for processing to be restricted rather than for the data to be deleted. You might do this if you need the data to support a legal claim. Restricting means that it would be processed in a limited way, such as continuing to be stored, but nothing more.

An organisation must also restrict processing if you have objected to it, while an investigation is carried out as to who is correct.

If the data was provided to a third party, the organisation must inform that party that you have exercised your right to restrict further processing, unless doing so is not possible or not likely to be effective. The organisation is not under any obligation to make sure that the third party does not further process it.

If the organisation decides that it will start processing the data again, it must tell you before doing so.