Article 18 GDPR
Right to restrict processing

1. The data subject has the right to request the controller to restrict processing in the following cases:

(a) the data subject disputes the accuracy of the personal data for a period allowing the controller to verify the accuracy of the personal data;

(b) the processing is unlawful and the data subject objects to the deletion of the personal data, requesting in return to restrict their use;

(c) the controller no longer needs personal data for processing purposes, but they are needed by the data subject to establish, investigate or defend claims;

(d) the data subject has objected under Article 21 (1) to the processing until it has been established whether the legitimate grounds on the part of the controller prevail over the grounds of objection of the data subject.

2. If processing has been restricted pursuant to paragraph 1, such personal data may be processed, with the exception of storage, only with the consent of the data subject, or to establish, assert or defend claims, or to protect the rights of another natural or legal person, or for compelling reasons of public interest of the Union or a Member State.

3. Before lifting a restriction on processing, the controller shall inform the data subject who requested the restriction under paragraph 1.