Right to restriction of processing (GDPR Art. 18)

The right to restriction (GDPR Art. 18) sits between "do nothing" and "delete everything". You temporarily freeze processing: the business may keep the data stored but must stop using it — no processing, no transfers, no profiling. Four grounds: (1) You contest the accuracy of the data and the business is verifying (freeze during verification). (2) Processing is unlawful but you don't want erasure (e.g. you still need the data for a legal claim). (3) The business no longer needs the data, but you do — for a legal claim against them or a third party. (4) You've objected (Art. 21) and the business is still weighing whether your interest prevails. What may the business still do? Only: storage, get your consent, use for a legal claim, or vital interests of others. Nothing else. How to request? In writing, with the ground (one of the 4) and what you want blocked. Practical value: this right is strong in disputes where you need time to gather evidence. E.g. an ex-employer about to share your HR data with a reference request — request restriction + objection together. The business must stop until it's resolved. Response time: 1 month. Lifting the restriction: they may only lift it after informing you. If they forget? AP complaint.