The Right to Restrict Processing
Under the General Data Protection Regulation (GDPR), you have a number of rights regarding the way in which we are allowed to process your personal data.
What is the Right to Restrict Processing?
GDPR gives you the right to restrict the processing of your personal data in certain circumstances. This means that you can limit the way that we use your data. This is an alternative to requesting the erasure of your data.
You have the right to restrict the processing of your personal data where you have a particular reason for wanting the restriction. This may be because you have issues with the content of the information we hold or how we have processed their data. In most cases any restriction will not be put in place indefinitely, but for a certain period of time.
When does the Right to Restrict Processing apply?
You have the right to request that we restrict the processing of your personal data in the following circumstances:
- you contest the accuracy of your personal data and you request that we verify its accuracy;
- your data has been unlawfully processed but rather than request erasure, you wish to restrict processing;
- we no longer need the personal data but the you need us to keep it in order to establish, exercise or defend a legal claim; or
- you have objected to us processing your data, and we are considering whether our legitimate grounds override yours.
Although this is distinct from the right to rectification and the right to object, there are close links between those rights and the right to restrict processing:
- if you have challenged the accuracy of your data and asked us to rectify it, you also have a right to request that we restrict processing while we consider your rectification request; or
- if you exercise your right to object to our processing of your data, you also have a right to request that we restrict processing while we consider your objection request.
- How do we restrict processing?
It is important to note that the definition of processing includes a broad range of operations including collection, structuring, dissemination and erasure of data. Therefore, we will use methods of restriction that are appropriate for the type of processing we are carrying out.
The GDPR suggests a number of different methods that could be used to restrict data, such as:
- temporarily moving the data to another processing system;
- making the data unavailable to users; or
- temporarily removing published data from a website.
When can we lift the restriction?
In many cases the restriction of processing is only temporary, specifically when the restriction is on the grounds that:
- you have disputed the accuracy of the personal data and we are investigating this; or
- you have objected to us processing your data on the basis that it is necessary for the performance of a task carried out in the public interest or the purposes of our legitimate interests, and we are considering whether our legitimate grounds override your rights.
Once we have made a decision on the accuracy of the data, or whether our legitimate grounds override your rights, we may decide to lift the restriction.
If we do this, you will be informed before the restriction is lifted.
Submitting a request
An Information Rights Request under GDPR may be submitted in either of the following ways:
- By submitting the online form under Apply for This Service below.
- By writing to Information Governance, Mendip District Council, Council Offices, Cannards Grave Road, Shepton Mallet, BA4 5BT
You must include your full name, a return address and a details of the information that you are requesting. Mendip District Council has a duty to verify the identity of requesters, and consequently you may be asked to provide proof of your identity.