Art.18 Right to restriction of processing
Restrict processing on request where the data subject contests the accuracy of the data, for a period enabling the controller to verify it; where the processing is unlawful and the data subject opposes erasure and asks f
5
artefacts
1
held by a system
3
at each review
hard
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Restriction records showing the ground, the date applied, and the date and reason for lifting · Data governance / DLP tooling
periodic reviewEvidence produced at each review
- Evidence the data subject was informed before each restriction was lifted · Data governance / DLP tooling
- Testing showing restricted records are excluded from downstream processing, marketing selections and analytics · Data governance / DLP tooling
- Evidence of the Article 19 notification to recipients following each restriction · Data governance / DLP tooling
governing documentDocuments that govern the control
- The technical mechanism that enforces restriction, such as a flag that blocks processing rather than one that is advisory only · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Data governance / DLP tooling on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Restriction implemented as a note on the record that no system enforces, so processing continues unchanged
- Restriction lifted the moment the accuracy check completes, with no prior notice to the data subject
- Restricted records still flowing into exports, reports and model training because only the customer facing application reads the flag
- No distinction maintained between restriction and erasure, so the request is actioned as a deletion the data subject did not ask for
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.17 Right to erasure (right to be forgotten) · Art.19 Notification obligation regarding rectification, erasure or restriction