What is the right to restrict processing?

A subscriber tells you the email address you have on file for them is incorrect, and they want you to fix it. While you're verifying the correction, they can ask you to pause all active processing of their record. You don't delete it. You don't keep using it. You hold it. That's the right to restrict processing under GDPR Article 18, and it's one of the rights email senders are least prepared for.

Restriction applies in four specific situations: the subscriber disputes the accuracy of your data and wants you to pause while they verify; your processing is unlawful but they prefer restriction over deletion; you no longer need the data but they need it preserved for a legal claim; or they've objected to your processing under Article 21 and you're assessing whether your legitimate interests override theirs. Outside those four cases, a subscriber can't demand restriction; they'd use a different right, like erasure or objection.

In practice, "restricting" a record means flagging it so it's excluded from marketing sends, analytics profiling, and any other active use. Most ESPs have a suppression flag that handles the sending side, but that alone doesn't cover everything if you're also running analytics or data enrichment on that record. You need to pause all non-essential processing, not just emails. Keep an audit trail showing when you applied the restriction, why, and exactly what you paused.

One nuance worth knowing: restriction doesn't mean the data disappears. You can still store it, use it with the person's consent, use it for a legal claim, or use it to protect someone else's rights. When the restriction period ends (you've resolved the accuracy dispute, or concluded the objection assessment), you need to notify the subscriber before you lift it. They have the right to know the restriction is being removed.

The easiest way to handle this operationally is to add "restricted" as a distinct status in your data management workflow, separate from "deleted" or "unsubscribed." That way restriction requests don't get confused with the others, you can track how long each one has been active, and you've got a documented trail if it's ever questioned.