Right to restriction — freeze contested data (Art. 18)

The right to restriction (Art. 18) freezes data instead of deleting it — kept, but not processed further. The four triggers: (1) you contest accuracy — frozen while they verify; (2) the processing is unlawful but you prefer freezing over erasure — because you want the evidence to survive; (3) they no longer need the data but you need it preserved for a legal claim; (4) you objected under Art. 21 and the balancing test is pending. Why it beats erasure in a fight: deletion destroys the record you may need in court, and companies process on while “investigating” your complaints — restriction stops the harm now. The killer use case: a disputed default flag at a credit bureau. Demand restriction the day you contest it and the flag stops feeding lending decisions while the dispute runs, instead of wrecking applications for months. What restricted data may still be used for: storage, your own legal claims, protecting others’ rights, or with your consent — nothing else, and they must tell you before lifting the restriction (Art. 18(3)). Recipients of the data must be informed of the restriction too (Art. 19). The ask: one line added to any accuracy or objection letter — “Pending resolution, I demand restriction of processing under Art. 18(1) GDPR and confirmation of it.” Ignored? The standard escalation applies, and DPAs treat ignored restriction demands as seriously as ignored access requests.