The right to restrict processing

The next right is the right to restrict processing, which allows an individual to limit the way that an organisation uses their data. This is an alternative to requesting the erasure of their data. If an individual exercises this right, you may store their data but you must not process it in any other way, unless you have the individual’s consent, or if it is for the establishment, exercise or defence of legal claims, or for the protection of the rights of another person either legal or natural, or, when the data is processed for reasons of public interest.

If the data has been shared with another organisation, then they must be notified of the restriction. If the individual asks for information about who the data is shared with you must provide them with that.

If you wish to refuse to comply with the restriction, you would need to be able to prove that it is manifestly unfounded or excessive, taking into account whether or not the request is repetitive in nature.

If you consider that a request is manifestly unfounded or excessive you can request a "reasonable fee" to deal with the request, or simply refuse to deal with the request. In either case, you will need to justify your decision.

You would need to inform the relevant individual as to the reasons you are not taking action so that they can have the right to complain to the ICO or another supervisory authority and tell them about their ability to seek to enforce this right through a judicial remedy.