# Restriction of Processing (Article 4(3) GDPR)
Restriction of processing means the marking of stored personal data with the aim of limiting their future processing. It corresponds to the former blocking and forms the technical basis for the right under Article 18 GDPR.
> Quelle: https://www.thomashelbing.com/en/wissen/dsgvo-hub/begriffe-und-definitionen/1.2.3-einschraenkung-der-verarbeitung
> Sprache: en
[Article 4(3) GDPR](https://dsgvo-gesetz.de/art-4-dsgvo/) defines restriction of processing as the marking of stored personal data with the aim of limiting their processing in the future. The definition is technology-neutral and describes both the operation (marking) and its purpose (limiting future processing).
**Key takeaways**
* Restriction of processing means that stored data are marked so that their future active use is blocked, without erasing them immediately.
* The concept is the successor to the former "blocking" under the old version of the German Federal Data Protection Act (BDSG) ([Recital 67 GDPR](https://dsgvo-gesetz.de/erwaegungsgruende/nr-67/)).
* The data subject's individual right to restriction arises from [Article 18 GDPR](https://dsgvo-gesetz.de/art-18-dsgvo/) and applies in four clearly defined situations.
* In automated systems, the restriction must be technically ensured through marking or isolation; purely organizational notes do not suffice.
* Archiving systems do not replace the restriction; they must themselves be able to implement it.
## 1 Overview [#1-overview]
As a [subcategory of processing](/docs/dsgvo-hub/begriffe-und-definitionen/1.2.2-verarbeitung), restriction of processing is itself a form of processing within the meaning of the GDPR. Its core idea: the data remain stored, but their active use is blocked by a technical or organizational marking. With the exception of mere storage, restricted data may be accessed only under the narrow conditions of [Article 18(2) GDPR](https://dsgvo-gesetz.de/art-18-dsgvo/), namely with the data subject's consent, for the establishment, exercise, or defense of legal claims, for the protection of another person, or for reasons of important public interest.
Under [Article 18(1) GDPR](https://dsgvo-gesetz.de/art-18-dsgvo/), the data subject has the right to restriction in four situations: where the accuracy of the data is contested (for the period enabling verification), where the processing is unlawful but the data subject opposes erasure, where the controller no longer needs the data but the data subject requires them for legal claims, and finally as long as an objection under Article 21(1) GDPR has not yet been conclusively assessed.
In substance, the term ties in with the former "blocking." [Recital 67 GDPR](https://dsgvo-gesetz.de/erwaegungsgruende/nr-67/) still uses the term "block" as a synonym, describing the same concept under a new name.
## 2 Methods of restriction [#2-methods-of-restriction]
[Recital 67 GDPR](https://dsgvo-gesetz.de/erwaegungsgruende/nr-67/) names three methods that show how a restriction can be technically implemented:
* temporarily moving the data to another processing system,
* making the data unavailable to users,
* temporarily removing published data from a website.
In automated filing systems, the restriction must in principle be ensured by technical means in such a manner that the data can neither be further processed nor changed ([Recital 67 GDPR](https://dsgvo-gesetz.de/erwaegungsgruende/nr-67/)). In addition, the existing restriction must be clearly indicated in the system.
## 3 Distinctions [#3-distinctions]
### 3.1 Relationship to the former blocking (old version of the BDSG) [#31-relationship-to-the-former-blocking-old-version-of-the-bdsg]
The earlier BDSG recognized blocking as a substitute for erasure where the latter was impossible, or possible only with disproportionate effort, owing to the nature of the storage. This provision lapsed when the GDPR entered into force. Systems that cannot technically implement erasure must therefore be supplemented with appropriate erasure routines. Restriction of processing under Article 4(3) GDPR fulfills a different function: it secures for the controller and the data subject a state of suspension in which the data are preserved but may not be actively used.
### 3.2 Restriction, archiving, and erasure compared [#32-restriction-archiving-and-erasure-compared]
The three measures pursue different aims and have different legal bases. The following table contrasts them:
| Feature | Restriction of processing | Archiving | Erasure |
| :---------------- | :------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------- |
| Aim | Block active use, preserve data | Long-term retention for evidentiary or archival purposes | Permanently and irretrievably remove data |
| Data holdings | Remain stored unchanged, only use restricted | Preserved, where applicable in a separate system | Removed entirely |
| Typical situation | Dispute over accuracy, objection proceedings, no further need on the controller's part | Retention periods under commercial or tax law, public archiving | Purpose ceased, no statutory retention obligation |
| Legal basis | [Article 18 GDPR](https://dsgvo-gesetz.de/art-18-dsgvo/) (data subject right) | [Article 89 GDPR](https://dsgvo-gesetz.de/art-89-dsgvo/) in conjunction with national archiving law (e.g., [BArchG](https://www.gesetze-im-internet.de/barchg_2017/)) | [Article 17 GDPR](https://dsgvo-gesetz.de/art-17-dsgvo/) (right to erasure) |
| Reversibility | The restriction can be lifted | Permanently retained, access limited | Not recoverable |
Archiving programs do not replace restriction of processing: they must themselves be able to implement restriction and erasure by technical means in order to meet the requirements of the GDPR. Permanent retention instead of erasure is permissible only on the basis of archiving law, and even then only subject to the safeguards of [Article 89 GDPR](https://dsgvo-gesetz.de/art-89-dsgvo/). The [German Federal Archives Act (BArchG)](https://www.gesetze-im-internet.de/barchg_2017/) applies to federal authorities and comparable public bodies; it does not apply to private companies. For the non-public sector, the relevant archiving laws of the individual German states (Länder) and the general GDPR principles are decisive.
---
## About the author
This article was written by [Dr. Thomas Helbing, specialist lawyer for IT law in Munich](https://www.thomashelbing.com/en).
Since 2020 and continuously through today (2026), Handelsblatt has [recognized](https://www.thomashelbing.com/en#auszeichnungen) Dr. Helbing as one of **"Germany's Best Lawyers"** in IT law and data protection law.
According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the **leading lawyers for data protection and IT law** and is listed among the **top 100 lawyers in Germany (2024/25)**. Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has **many years of advisory experience in data protection and IT law** and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.
His [professional background](https://www.thomashelbing.com/en#stationen) covers the **full spectrum of IT and technology law practice**. He began his career at a major international law firm, then gained **in-house experience at a DAX-listed company**, and is himself an **entrepreneur and founder of several digital ventures**. He also has **hands-on programming experience**, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.
For many years, his [clients](https://www.thomashelbing.com/en#referenzen) have included **technology companies and SaaS providers**, leading **German research institutions** and a **systemically important German bank**. His advisory focus lies in particular on **GDPR compliance, the data economy, SaaS, AI regulation and IT contract law**.