Litigation evidence needed: restrict processing under Article 18

Where a data subject still needs personal data as litigation evidence, Article 18(1)(c) GDPR may support a request to restrict processing. The provision requires that the controller no longer needs the data for its processing purposes while the data subject needs them for the establishment, exercise or defence of legal claims.

The result is a narrowly defined restriction: the data remain stored, but may generally be used only in the cases named by law. This article explains how to separate the claim, the evidential function, the restricted data set, recipients and the later lifting of the restriction.

Article 18(1)(c) GDPR combines two requirements. The controller no longer needs the personal data for its processing purposes. The data subject nevertheless needs the same data for the establishment, exercise or defence of legal claims. Only this combination creates the right to request restriction of processing.

The data do not have to be part of court proceedings already. The decisive point is the concrete link to the data subject’s own legal claim and the role of the data in pursuing or defending it. A mere assumption that records might become useful in a future dispute does not describe that link sufficiently.

The controller should document the end of the previous purpose separately from the data subject’s claim. A completed customer relationship, closed review or concluded contract may end the original purpose. That does not automatically require erasure if the data subject needs the data for their own claim.

The right to erasure under Article 17(1) GDPR applies, among other situations, where personal data are no longer necessary for the purposes for which they were collected or otherwise processed. Article 17(3)(e) excludes erasure to the extent processing is necessary for the establishment, exercise or defence of legal claims. Article 18(1)(c) addresses a separate fact pattern and produces a different legal result.

During restriction, storage remains permitted. Under Article 18(2) GDPR, further processing is generally limited to processing with the data subject’s consent, for the establishment, exercise or defence of legal claims, to protect the rights of another natural or legal person, or for an important public interest of the Union or a Member State.

Restriction is therefore neither a general litigation hold nor permission to retain the entire matter indefinitely. It protects the specific data set needed for the data subject’s legal claim. Other data must still be assessed independently under Article 17 GDPR.

A request should describe the data subject’s own legal claim in a way that allows the data link to be reviewed. Depending on the matter, this includes the data subject’s role, the relevant event, the disputed act or statement and the information needed for that issue. A final prediction of the outcome of civil or administrative proceedings is not required for the restriction review.

The evidential function may lie in a message, contract version, invoice, record, image, access event or other documentation. The organisation should record the claimed connection without restricting every record in the matter as a precaution. Data minimisation and storage limitation under Article 5(1)(c) and (e) GDPR remain applicable.

The origin of the data and possible changes also matter. Where a document is exported from an active system, the export is not automatically required in the same quantity as the original information. The review should distinguish the original, copies, metadata, comments and traces in other systems.

The restricted data set contains only the data needed for the described legal claim. For each group, specify the documents and fields concerned, where they are stored and which period is relevant. An entire user account, customer file or backup is not required simply because the sought information might be somewhere inside it.

The technical review must go beyond the primary record. Mailboxes, document stores, exports, local copies and processor systems may contain the same information. A restriction record must therefore align with permissions, search functions, interfaces and restoration procedures. Where processors are involved, the actual data flows and roles should be recorded.

The guide to erasure requests and retention obligations covers the related case of a statutory retention duty. The present situation starts differently: the data subject needs the data for their own legal claim and therefore requests restriction under Article 18(1)(c) GDPR.

Article 18(2) GDPR permits more than the technical existence of the data only in the listed situations. These include the data subject’s consent, the establishment, exercise or defence of legal claims, protection of the rights of another natural or legal person and an important public interest of the Union or a Member State.

The organisation should make the restriction trigger specific access rules. Remove the data from ordinary work views, stop automatic forwarding and exports, and limit handling to approved roles. Access for dealing with the legal claim must be documented differently from use for marketing, general customer care or a new analysis.

The technical access restriction is an implementation measure. It does not replace the review of Article 18(1)(c) GDPR and does not create a legal basis for other purposes. The record should therefore connect the legal decision with its technical implementation.

Where the affected data were disclosed, Article 19 GDPR generally requires the controller to communicate the restriction to all recipients. An exception applies where the communication is impossible or would involve disproportionate effort. If the data subject asks about those recipients, the controller must provide that information.

Identify the recipients to whom the specific restricted data set was sent. Depending on the processing, they may include internal departments, processors or other recipients. The recipient review concerns the restricted data set and should not be replaced by a general distribution list.

Article 18(3) GDPR requires the data subject to be informed before the restriction is lifted. The controller therefore needs a verifiable lifting trigger, such as the end of the claim link or a documented reassessment. An internal reminder date is not enough where the data link remains unresolved.

Under Article 12(1) GDPR, data subject rights must be handled transparently and in an understandable way. The record should contain receipt of the request, identification of the requesting person, the legal claim described and the affected data. This allows the organisation to explain later why some information was restricted and other information was not.

Article 12(3) GDPR generally requires a response within one month. The period for responding to the request is separate from the internal time needed for a technical search or implementation. Record receipt, any questions, the decision, the response and further steps with their dates.

The response should distinguish a full or partial restriction from erasure. State the scope, the permitted further use and the trigger for the next review. A clear explanation helps the data subject more than a general reference to an internal restriction note.

Start with the request and a data map. Record the data subject, own legal claim, procedural role, claimed data link, data categories, documents, systems, copies and recipients. Assign each group a decision: erase, continue processing or restrict under Article 18 GDPR.

The restriction record should reflect the decision in a verifiable form. Record the previous purpose, the end of that purpose, the claim link, the evidential function, the restricted data set, permitted access, technical implementation and responsibility. Add the lifting trigger, the next review point and the recipient review.

Then check whether the technical restriction works. Search for open views, automatic exports, local copies and processor access. Record the response to the data subject and reassess the data set when the claim, purpose or system environment changes.

We review the request, the data subject’s legal claim, evidential function, required restricted data set, permitted processing and recipients against the actual data flows. For an initial assessment, please provide the request, affected documents, storage locations, previous use and any restriction record. Contact us if data should be protected before erasure while processing must remain limited and traceable.