GDPR restriction of processing response letter

Individuals have a right in certain circumstances to prevent the processing of their personal data. If processing is restricted, you can store the data, but you have limited rights to process it. Use our letter where you’ve restricted processing.

Restrictions on processing

Under the UK GDPR, individuals can submit a request that you restrict the processing of particular personal data that you hold about them. Once you’ve dealt with their request, you can then use our GDPR Restriction of Processing Response Letter to advise them what you’ve done to restrict the relevant processing. Where processing was restricted because the individual contested the accuracy of the personal data, our letter enables you to set out how long the restriction will apply while you verify the data’s accuracy. Where processing was restricted because the individual objected to it in circumstances where it was being undertaking in reliance on it being necessary for the purposes of your legitimate interests (or those of a third party), but they believe there are no overriding legitimate grounds for the processing, our letter permits you to set out when you expect to be able to advise them of your position on whether your legitimate grounds override theirs.

No restrictions

If you haven’t restricted processing of some or all of the personal data as requested, do set out why. This is because, if you don’t take any action on the request of the individual, you must inform them without delay, and at the latest within one month of receipt of their request, of the reasons for not taking any action. They then have the right to complain to the Information Commissioner’s Office, or to seek a judicial remedy, and you need to inform them that they may do this.

Permitted processing

Where processing has been restricted in accordance with the individual’s request, with the exception of storage you can only then process the relevant personal data:

• with the individual’s consent,
• for the establishment, exercise or defence of legal claims,
• for the protection of the rights of another natural or legal person, or
• for reasons of important public interest.

You must also inform the individual before the restriction on the processing of the personal data is lifted. Our letter includes a paragraph providing all this information to the individual.

Third-party recipients

As you’re also required to let any third parties know about the restriction on processing of personal data if the relevant data has been disclosed to them, unless this proves impossible or involves disproportionate effort, our letter includes optional paragraphs covering this.