What it asks for. Individuals can require a controller to restrict processing where they contest the accuracy of the data, where processing is unlawful but they prefer restriction to erasure, where the controller no longer needs the data but the individual needs it for legal claims, or where they have objected under Article 21(1) pending verification.
In practice. Once restricted, the data may be stored but otherwise processed only with consent, for legal claims, to protect the rights of another person, or for important reasons of public interest. Systems need a technical way to flag and block restricted records, such as moving them to a separate store or marking them so they are excluded from processing. The individual must be told before the restriction is lifted, and recipients informed under Article 19. Evidence includes the procedure, system flags and the request log.
Common gaps. Many organisations cannot technically restrict a record short of deleting it, so restriction is handled by manual notes that automated processing ignores.