Guidelines 10/2020 on restrictions under Article 23 GDPR

What it covers

These guidelines interpret Article 23 GDPR on restrictions of data subject rights and controller obligations, covering the requirements for lawful legislative restrictions, the exhaustive grounds on which they may be based, the necessity and proportionality test, the safeguards required, consultation with supervisory authorities, and the consequences of non-observance.

Why it matters

It is the key reference for assessing when and how Member State or Union law may lawfully limit GDPR rights such as access, rectification or erasure, which is essential when analysing national restriction laws.

Refer to it when

• assessing whether a national law restricting data subject rights is GDPR-compliant
• determining what safeguards a restriction must contain
• understanding when a supervisory authority must be consulted on a restriction
• advising on data subject rights after a restriction ends

Questions this document addresses

• What conditions must a legislative restriction under Article 23 satisfy?
• Which grounds justify restricting data subject rights?
• What safeguards must accompany a restriction?
• What happens when a controller fails to comply with restriction requirements?

Topics

• Restrictions (Art. 23)
• Data subject rights
• Supervisory authorities