If you do not want your data processed
In certain situations, you have the right to restrict the processing of your personal data. You can also object to the processing of your personal data if you do not want it processed at all.
Personal data refers to information by which you can be identified.
A company, authority or corporation that collects your personal data is called a controller.
You can request the processing of your personal data to be restricted
In certain cases, you can request the controller to restrict the processing of your personal data. Restriction means that the controller will only be permitted to process your personal data
- with your consent
- for the establishment, exercise or defence of legal claims
- in the public interest or
- in order to safeguard the rights of another person.
You can restrict the processing of your personal data in the following situations:
- You consider the data to be inaccurate.
- Your data is being processed unlawfully, but you do not want them erased completely.
- The controller no longer needs your data for their original purpose, but you need it for the establishment, exercise or defence of legal claims.
- You have objected to the processing of your personal data (requested that the controller not process them at all), but the final decision is still pending.
If the controller restricts the processing of your data, it must communicate the restriction to all parties to whom the data have been disclosed in the past if viable. You can ask the controller to tell you the recipients of your data.
You can object to the processing of your data
In certain situations, you can also object to the processing of your personal data, i.e. request that it not be processed at all.
Objecting is possible if the controller is processing your data on the basis of public interest or the exercise of official power or on the basis of legitimate interest. An example of processing based on legitimate interest would be using your personal data for direct marketing.
You can object to the processing of your data on grounds relating to your particular situation. In the case of direct marketing, however, you do not need to justify your objection.
How to proceed
Make the request directly to the controller. Additional information on the correct channels can usually be obtained from the controller's website or customer service.
In the request, specify
- whether you wish to restrict or object to the processing of your personal data
- the reasons for restricting or objecting to the processing, except in the case of direct marketing
- your name and
- your contact details (such as your e-mail address or telephone number).
The controller is required to reply to your request within one month. If the requests are numerous or complex, the controller can reply that it needs more time to process them. If the controller announces that it needs more time for processing, the deadline for replying will be three months from your original request. Wait for the controller's reply. Notifying you of a longer processing time does not mean that the controller will refuse your request. If the controller does not reply to you within the deadline, you can contact the Data Protection Ombudsman.
If the controller refuses your request, it must state the reasons for its refusal. The refusal must always be based on law. If you feel that the controller did not have legal grounds for its refusal, you can contact the Data Protection Ombudsman if necessary.
Notification to the Data Protection Ombudsman