When can someone ask us to restrict processing?

Article 18(1) GDPR gives four grounds: the person contests the accuracy of the data (for the time you need to check it); the processing is unlawful but they want restriction instead of erasure; you no longer need the data but they need it for a legal claim; or they objected under Article 21(1) and you are checking whether your legitimate grounds override theirs.

What may we still do with restricted data?

Under Article 18(2) you may keep storing it. Anything else needs the person's consent, or must be for the establishment, exercise or defence of legal claims, the protection of the rights of another person, or important public interest of the Union or a Member State. Recital 67 suggests methods such as moving the data to another system, making it unavailable to users or taking it off a website, and says the restriction should be clearly marked in the system.

How fast must we reply, and who else must we tell?

Article 12(3) says you must tell the person what you did without undue delay and within one month of receipt, extendable by two further months for complex or numerous requests if you tell them within the first month. Article 19 says you must pass the restriction on to each recipient you disclosed the data to, unless that is impossible or involves disproportionate effort, and tell the person who those recipients are if they ask. Article 18(3) says you must tell the person before you lift the restriction.

Someone disputes what your AI tool says about them? A GDPR Article 18 restriction request sheet for small businesses

Updated 25 Oct 2026 · Disclosure: the EURO AI Register mentioned below is an Unadhi product with a free edition. This guide is for information only, not legal advice.

What you get: a finished restriction request sheet: one row per request, a column to pick which of the four Article 18 grounds applies, a reply-date formula (one month, or three with an extension), a list of every AI tool and export holding the data with how you froze it, the suppliers you told under Article 19, a status formula, the notice before lifting, and two made-up example rows.

Short answer: if someone says what your AI tool recorded about them is wrong, or objects to how you use it, they can ask you to stop using that data while you check. You then keep it but do not use it, except with their consent or for legal claims and a few other narrow reasons. Reply within one month, tell the suppliers you shared it with, and tell the person before you lift the restriction.

Step 1: spot the request

Typical AI cases: "your call summary says I agreed to something I never agreed to", "your chatbot logged the wrong complaint", "stop using that AI lead score until you check it", "keep my data, I need it for my dispute with you".
Log it on the day it arrives. The one-month clock in Article 12(3) starts on receipt, not when someone reads the inbox.
If you have reasonable doubts about who is asking, you may ask for information to confirm identity (Art. 12(6)); note it in column C.

Step 2: the restriction request sheet (one row per request)

Column	What to write	Source
A. Received	Date the request arrived and how (email, form, phone, chat). Any wording counts; the person does not have to say "Article 18"	Art. 12(2), 12(3)
B. Reply due	`=EDATE(A2,1)`. If the request is complex and you extend, the new date is `=EDATE(A2,3)` and you must tell the person, with reasons, before B2	Art. 12(3)
C. Person and data	Who asked (identity checked how), and which data: an AI call summary, a chatbot transcript, an AI lead score, an AI-written note on their file	Art. 12(6)
D. Ground	Pick one: 1 accuracy contested · 2 unlawful, wants restriction not erasure · 3 you no longer need it, they need it for a legal claim · 4 objection under Art. 21(1) being checked. Ground 1 usually comes with a rectification request; ground 4 with an objection	Art. 18(1)(a) to (d)
E. AI tools holding it	Every place the data sits: the AI tool itself, its exports, your CRM, shared drives, the supplier's history or training settings. Copy the list from your Article 30 records	Art. 30(1); Recital 67
F. How you froze it	One line per place in E: moved to a locked folder, hidden from users, export deleted, automations and AI re-scoring switched off for that person, label "RESTRICTED, do not use" added	Recital 67
G. Allowed uses while restricted	Storage only, unless one of the exceptions applies: the person's consent, legal claims, another person's rights, important public interest. Write which one and why, or "storage only"	Art. 18(2)
H. Recipients told	Each supplier, client or partner you disclosed the data to, date told, or why it was impossible or disproportionate. Note if the person asked for the list and when you sent it	Art. 19
I. Status	`=IF(L2<>"","Lifted",IF(TODAY()>B2-7,"Reply due within 7 days","Restricted"))`. The 7-day warning is your own working rule, not a legal one	Art. 12(3)
J. Check result	Ground 1: accurate or corrected (date). Ground 4: whether your legitimate grounds override theirs. Grounds 2 and 3: when the reason ends	Art. 18(1)
K. Told before lifting	Date you told the person the restriction will be lifted, and the reason. Do this before you lift it	Art. 18(3)
L. Lifted	Date the restriction was removed in every place in E, and who checked	Art. 5(2)

Sort by column I so "Reply due within 7 days" comes first. In a spreadsheet, put the column letters A to L in row 1 and the first request in row 2; the formulas above assume that layout.

Step 3: freezing data inside AI tools

Recital 67 says that in automated systems the restriction should in principle be ensured by technical means, so the data is not processed further and cannot be changed, and the restriction should be clearly marked in the system.
In practice for small teams: export the disputed record to a locked folder, remove the person from AI scoring, follow-up automations and mailing lists, and add a visible "restricted" tag in your CRM so nobody acts on the AI output.
Check the supplier side too: chat history, saved prompts, and whether the tool may use your data for training. Our privacy by default settings sheet lists where these switches usually are.

Two example rows (made-up businesses, for illustration only)

Example 1, a small IT services firm, "Example AI call summary tool": A. 03/11/2026 by email · B. 03/12/2026 · C. existing client contact, identity known; AI summary of a support call · D. ground 1, accuracy contested ("I never approved the upgrade") · E. AI tool history, CRM note, ticket export · F. summary moved to locked folder, CRM note tagged "RESTRICTED", auto-invoice for the upgrade paused · G. storage only · H. none; data not shared · I. Restricted · J. call recording checked 10/11/2026: summary wrong, corrected under Article 16 · K. client told 11/11/2026 · L. 12/11/2026, office manager.

Example 2, a small online shop, "Example AI customer risk score": A. 05/11/2026 via contact form · B. 05/12/2026 · C. customer, identity confirmed by order number; AI fraud-risk score · D. ground 4, objection under Article 21(1) being checked · E. shop plugin, payment-review list · F. score hidden from staff, customer removed from automatic review list · G. storage only · H. plugin supplier told 06/11/2026; customer asked for the list, sent 06/11/2026 · I. Restricted · J. legitimate interest assessment re-run 20/11/2026 · K. customer told 21/11/2026 with reasons · L. 28/11/2026.

Do this week

Add a "restriction" option to whatever form or inbox you use for access requests
For each AI tool in your records, write one line on how you would freeze one person's data in it
List the suppliers and partners you pass AI outputs to, so column H takes minutes
Agree who may lift a restriction and that the person is told first

This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 12, 18, 19 and 21 and Recital 67, as published on gdpr-info.eu). Your national data protection authority may publish its own guidance on data subject rights; check it. Example rows are made up for illustration and do not describe any real business or supplier. Checked on 25 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.

For accountants and tax advisers

Disputes about AI call summaries and AI scores tend to land with the business owner at the same time as a billing or contract dispute. Hand clients this sheet with the rectification sheet and the client AI inventory, so each request has a dated row. Stay inside your professional rules and refer legal questions on.

Keep requests next to your AI register

The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once and attach each restriction row as an evidence record.

When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

Article 18 GDPR, Right to restriction of processing (with Article 19, Notification obligation, Article 12, Transparent information and modalities and Recital 67); official text: Regulation (EU) 2016/679

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.