What is the right to restrict processing?

The right to restrict processing under GDPR allows individuals to limit how their data is used without deleting it entirely. When restriction is invoked, you can store the data but cannot actively process it for marketing, analytics, or other purposes until the restriction is lifted.

This right applies in specific situations: when someone contests the accuracy of their data (restriction applies while you verify), when processing is unlawful but the individual prefers restriction over deletion, when you no longer need the data but the individual needs it for legal claims, or when the individual has objected to processing and you're evaluating whether your legitimate interests override theirs.

In practice, this means flagging the record and excluding it from all campaigns, segmentation, and automated processing. The data sits in a holding pattern. You must inform the individual before lifting any restriction.

Think of it as placing cargo in quarantine. It's still on the ship, but it doesn't move until clearance is granted.