§ GDPR · Article 18
GDPR Article 18: Obligations, Deadlines & Penalties
At a glance
Article 18 of the GDPR imposes 3 obligations on controller. At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 18
Obligation 1
The controller must restrict the processing of personal data when the data subject contests accuracy, processing is unlawful, data is no longer needed but required for legal claims, or an objection is pending verification.
Regulation (EU) 2016/679, Article 18, Article 18
- Obligated entity
-
controller
- Action required
-
restrict
- Deadline
-
—
- Penalty
-
—
Obligation 2
Where processing has been restricted, the controller shall only process such personal data with the data subject's consent, for legal claims, for protection of rights, or for important public interest, with the exception of storage.
Regulation (EU) 2016/679, Article 18, Article 18
- Obligated entity
-
controller
- Action required
-
process
- Deadline
-
—
- Penalty
-
—
Obligation 3
The controller must inform the data subject before the restriction of processing is lifted.
Regulation (EU) 2016/679, Article 18, Article 18
- Obligated entity
-
controller
- Action required
-
inform
- Deadline
-
before the restriction of processing is lifted
- Penalty
-
—
§ Frequently asked
Questions about Article 18
Who must comply with Article 18 of the GDPR?
+
controller.
What does Article 18 of the GDPR require?
+
restrict process inform
What is the compliance deadline for GDPR Article 18?
+
before the restriction of processing is lifted