GDPR restriction of processing request form

One of the data subject rights in the UK GDPR is to obtain restriction of processing of their personal data. Our form provides a straightforward way for them to make a request for this.

The statutory right

Under the UK GDPR, an individual can require you to restrict processing of their personal data where any one of the following applies:

• the individual contests the accuracy of the personal data - in this case, the processing is then restricted for a period to enable you to verify the accuracy
• the processing of the personal data is unlawful, but the individual opposes its erasure and requests the restriction of its use instead
• you no longer need to process the personal data, but it’s required by the individual for the establishment, exercise or defence of legal claims
• the individual has objected to processing which you’ve been undertaking in reliance on either the processing being necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in you, or the processing being necessary for the purposes of your legitimate interests or those of a third party, and there are no overriding legitimate grounds for the processing - in this case, the processing is then restricted pending verification of whether your legitimate grounds override those of the individual.

Form of request

Although you can make available our GDPR Restriction of Processing Request Form to enable individuals to make rectification requests, they can still make their request by any means as the UK GDPR doesn’t set out a specific form of request. Our form asks the individual to provide sufficient details to enable you to identify them and the specific personal data in respect of which they wish processing to be restricted. It also asks them to confirm which of the four grounds above they’re relying on in making their request to restrict processing.

Third-party recipients

You must communicate any restriction of processing carried out in accordance with this provision to each third-party recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort.

compliance deadline

An individual has the right to require you to restrict the processing of their personal data without undue delay, and in any event within one month of receipt of the request. However, that period can be extended by two further months where necessary, taking into account the complexity and number of their requests. Where an individual obtains restriction of processing under these provisions, you must then inform them before that restriction of processing is subsequently lifted.