Right to restrict processing: pausing use of your data

Section 45 of the Data Protection Act, 2024 gives a data subject a right that sits between doing nothing and asking for full deletion: restriction of processing. The data is not erased, and the controller may still store it, but active use of it has to stop while a dispute or a question about the data gets resolved.

When restriction applies

Section 45(1) sets out the situations this covers, including:

The data subject shall have the right to obtain from the data controller restriction of processing where… the accuracy of the personal data is contested by the data subject, [or]… processing is unlawful and the data subject opposes the erasure of the personal data, but requests the restriction of the use of personal data instead. (s.45(1))

The first situation is the more common one in practice: while a business checks whether a piece of data is actually accurate, section 45 lets the data subject ask for it to be frozen rather than continuing to be relied on in the meantime. The second covers a case where the processing turns out to have been unlawful, but the data subject would rather the data was paused than deleted outright, for instance because they still want to be able to point to it later.

What “restricted” actually means

Restriction is not a euphemism for deletion, and it is not business as usual either. Under section 45(2), once processing is restricted, the data can still be stored, but using it for anything else is limited to a narrow set of situations, such as with the data subject’s consent or to establish or defend a legal claim. For everyday purposes, it is effectively parked.

Section 45(3) also protects the data subject at the other end of the process: a controller has to tell them before lifting a restriction, so the pause cannot simply expire unannounced and processing quietly resume.

Telling other recipients

The same notification duty that applies to corrections and deletions applies here too. Section 46 requires a controller to tell every recipient the data was previously shared with that processing has now been restricted, unless doing so is impossible or would take disproportionate effort. See right to correction for how that notification duty works in more detail.

If the goal is to have the data removed entirely rather than paused, that is a different right: see right to deletion for the grounds and exceptions that apply there instead.