Article 18. Right to restriction of processing

(1) The data subject shall have the right to obtain from the controller restriction of processing in one of the following cases:

1. a) the data subject contests the accuracy of the personal data – for a period enabling the controller to verify the accuracy of the data;
2. b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. c) the controller no longer needs the personal data for the purposes of the processing, but the data subject requests them for the establishment, exercise or defence of a right in administrative, judicial or out-of-court proceedings;
4. d) the data subject objects to processing pursuant to art. 21(1) – for the period during which it is verified whether the legitimate rights of the controller override those of the data subject.

(2) Where processing has been restricted under paragraph (1), such personal data may, with the exception of storage, be processed only with the data subject’s consent or for the establishment, exercise or defence of a right in administrative, judicial or out-of-court proceedings or for the protection of the rights of another natural or legal person or for reasons of important public interest.

(3) A data subject who has obtained restriction of processing pursuant to paragraph (1) shall be informed by the controller before the restriction of processing is lifted.