Right to Restriction

The right to restriction imposes a temporary freeze on processing, distinct from the right to erasure. Data is preserved solely for legal claims, defense, or protecting another person's rights. During this period, the data controller must move the data to a restricted access state, often implemented via a restricted processing flag in the database, preventing any active use while the dispute is resolved.

A data subject can invoke this right only under four specific circumstances defined in Article 18 of the GDPR:

• Accuracy Contested: Processing is paused while the controller verifies the data's accuracy.
• Unlawful Processing: The subject opposes erasure and requests restriction instead.
• No Longer Needed: The controller no longer needs the data, but the subject requires it for a legal claim.
• Objection Pending: Processing is paused while verifying if the controller's legitimate grounds override the subject's objection.

In AI pipelines and databases, this right is technically enforced through logical access controls rather than physical deletion. Common methods include:

• Setting a processing_restricted boolean flag to TRUE in the data record.
• Moving data to a separate, immutable restricted archive store with read-only permissions.
• Revoking all API tokens and service accounts that have processing access to the specific data subject's records.

The controller must communicate any rectification, erasure, or restriction of processing to each recipient to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort. In machine learning contexts, this implies a need for robust data lineage tracking to identify all downstream models, analytics dashboards, and third-party processors that ingested the restricted data.

Invoking restriction creates a critical challenge for continuous learning systems. A model cannot be retrained or fine-tuned on data under restriction. This requires Training Data Isolation architectures to immediately exclude flagged records from feature stores and training pipelines. The data must be logically quarantined to prevent its inclusion in batch inference jobs or real-time feature computations until the restriction is lifted.

The controller must inform the data subject before lifting a processing restriction. This ensures the subject has an opportunity to escalate the dispute or exercise other rights, such as erasure. Automated systems must include a human-in-the-loop approval step before a restricted flag can be programmatically removed to ensure compliance with this mandatory notification requirement.