Under the DPA, individuals have a right to ‘block’ or suppress processing of personal data. The restriction of processing under the GDPR is similar.
When processing is restricted, you are permitted to store the personal data, but not further process it. You can retain just enough information about the individual to ensure that the restriction is respected in future.
When does the right to restrict processing apply?
You will be required to restrict the processing of personal data in the following circumstances:
You may need to review procedures to ensure you are able to determine where you may be required to restrict the processing of personal data.
If you have disclosed the personal data in question to third parties, you must inform them about the restriction on the processing of the personal data, unless it is impossible or involves disproportionate effort to do so.
You must inform individuals when you decide to lift a restriction on processing.