[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F18":3},{"item":4,"lessons":16,"controls":22,"related":27},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","18","Article 18","Right to restriction of processing",1,"General Data Protection Regulation","**What it asks for.** Individuals can require a controller to restrict processing where they contest the accuracy of the data, where processing is unlawful but they prefer restriction to erasure, where the controller no longer needs the data but the individual needs it for legal claims, or where they have objected under Article 21(1) pending verification.\n\n**In practice.** Once restricted, the data may be stored but otherwise processed only with consent, for legal claims, to protect the rights of another person, or for important reasons of public interest. Systems need a technical way to flag and block restricted records, such as moving them to a separate store or marking them so they are excluded from processing. The individual must be told before the restriction is lifted, and recipients informed under Article 19. Evidence includes the procedure, system flags and the request log.\n\n**Common gaps.** Many organisations cannot technically restrict a record short of deleting it, so restriction is handled by manual notes that automated processing ignores.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_18","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"bbva-italy-fined-55m-for-ignoring-gdpr-opt-out-requests","BBVA Italy Fined €5.5M for Ignoring GDPR Opt-Out Requests","2026-09-16T10:21:59.106+00:00",[23],{"slug":24,"name":25,"problem":26,"stories":9},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[28,33,37,41,45,49,53,58],{"family":29,"item":30,"code":31,"title":32,"together":9},"cis","3","Control 3","Data Protection",{"family":29,"item":34,"code":35,"title":36,"together":9},"8","Control 8","Audit Log Management",{"family":5,"item":38,"code":39,"title":40,"together":9},"17","Article 17","Right to erasure ('right to be forgotten')",{"family":5,"item":42,"code":43,"title":44,"together":9},"21","Article 21","Right to object",{"family":5,"item":46,"code":47,"title":48,"together":9},"24","Article 24","Responsibility of the controller",{"family":5,"item":50,"code":51,"title":52,"together":9},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":54,"item":55,"code":56,"title":57,"together":9},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",{"family":59,"item":60,"code":61,"title":61,"together":9},"itil","overview","ITIL"]